Contest Gallery – Upload & Vote Photos, Media, Sell with PayPal & Stripe

JPG, PNG, MP4, MP3, PDF, ZIP & more. Create voting & uploading galleries for photos & media. Social Share, User Registration & Sell via PayPal/Stripe.

v30.0.4Wasiliy Strecker / ContestGallery developerUpdated Added 1k+ installs88% rating
23
Score
9,310
Errors
26,642
Warnings
+0
Change

Category Scores

Security0
Repo85
Performance98
Maintainability0

Issues to Review

Prioritized issue groups from the latest Plugin Check scan

35,952 findings

Maintainability

21,992

11 issue groups

Security

11,429

11 issue groups

I18n

2,008

3 issue groups

WARNINGMaintainabilityNon-prefixed global variableGlobal variables defined by a theme/plugin should start with the theme/plugin prefix. Found: "$ActivateBulkUpload".16,546
Category
Maintainability
Occurrences
16,546
Severity
warning

Sample message

Global variables defined by a theme/plugin should start with the theme/plugin prefix. Found: "$ActivateBulkUpload".

ERRORSecurityHeredoc Output Not EscapedAll output should be run through an escaping function (see the Security sections in the WordPress Developer Handbooks), found interpolation in unescaped heredoc.2,529
Category
Security
Occurrences
2,529
Severity
error

Sample message

All output should be run through an escaping function (see the Security sections in the WordPress Developer Handbooks), found interpolation in unescaped heredoc.

WARNINGSecurityInterpolated SQL is not preparedUse placeholders and $wpdb->prepare(); found interpolated variable $AdditionalFilesMainRealId at "SELECT MultipleFiles FROM $tablename1 WHERE id = '$AdditionalFilesMainRealId'"2,228
Category
Security
Occurrences
2,228
Severity
warning

Sample message

Use placeholders and $wpdb->prepare(); found interpolated variable $AdditionalFilesMainRealId at "SELECT MultipleFiles FROM $tablename1 WHERE id = '$AdditionalFilesMainRealId'"

ERRORSecurityOutput is not escapedAll output should be run through an escaping function (see the Security sections in the WordPress Developer Handbooks), found '" $BorderRadiusClass' data-cg-entry-id='$entryId' data-cg-real-gid='$realGid'>"'.2,106
Category
Security
Occurrences
2,106
Severity
error

Sample message

All output should be run through an escaping function (see the Security sections in the WordPress Developer Handbooks), found '" $BorderRadiusClass' data-cg-entry-id='$entryId' data-cg-real-gid='$realGid'>"'.

WARNINGMaintainabilityDirect QueryUse of a direct database call is discouraged.1,355
Category
Maintainability
Occurrences
1,355
Severity
warning

Sample message

Use of a direct database call is discouraged.

WARNINGMaintainabilityNo CachingDirect database call without caching detected. Consider using wp_cache_get() / wp_cache_set() or wp_cache_delete().1,354
Category
Maintainability
Occurrences
1,354
Severity
warning

Sample message

Direct database call without caching detected. Consider using wp_cache_get() / wp_cache_set() or wp_cache_delete().

WARNINGSecurityMissing nonce verificationProcessing form data without nonce verification.1,084
Category
Security
Occurrences
1,084
Severity
warning

Sample message

Processing form data without nonce verification.

ERRORMaintainabilityNot AllowedUse of heredoc syntax (<<<) is not allowed; use standard strings or inline HTML instead1,066
Category
Maintainability
Occurrences
1,066
Severity
error

Sample message

Use of heredoc syntax (<<<) is not allowed; use standard strings or inline HTML instead

WARNINGSecurityDatabase parameter is not escapedUnescaped parameter $contest_gal1ery_create_user_entries used in $wpdb-&gt;query()\n$contest_gal1ery_create_user_entries assigned unsafely at line 157.994
Category
Security
Occurrences
994
Severity
warning

Sample message

Unescaped parameter $contest_gal1ery_create_user_entries used in $wpdb-&gt;query()\n$contest_gal1ery_create_user_entries assigned unsafely at line 157.

ERRORI18nNon Singular String Literal DomainThe $domain parameter must be a single text string literal. Found: $domain855
Category
I18n
Occurrences
855
Severity
error

Sample message

The $domain parameter must be a single text string literal. Found: $domain

Show 15 more
ERRORI18nNon Singular String Literal Text855
Category
I18n
Occurrences
855
Severity
error

Sample message

The $text parameter must be a single text string literal. Found: $l_Account

WARNINGSecurityRequest data is not unslashed806
Category
Security
Occurrences
806
Severity
warning

Sample message

$_COOKIE[&#039;contest-gal1ery-&#039;.$galeryID.&#039;-voting&#039;] not unslashed before sanitization. Use wp_unslash() or similar

WARNINGMaintainabilityNon-prefixed function741
Category
Maintainability
Occurrences
741
Severity
warning

Sample message

Functions declared in the global namespace by a theme/plugin should start with the theme/plugin prefix. Found: &quot;cgDropTables&quot;.

WARNINGSecurityInput is not sanitized656
Category
Security
Occurrences
656
Severity
warning

Sample message

Detected usage of a non-sanitized input variable: $_COOKIE[$cookieName]

ERRORMaintainabilityMissing direct file access protection407
Category
Maintainability
Occurrences
407
Severity
error

Sample message

PHP file should prevent direct access. Add a check like: if ( ! defined( 'ABSPATH' ) ) exit;

WARNINGSecurityInput is not validated375
Category
Security
Occurrences
375
Severity
warning

Sample message

Detected usage of a possibly undefined superglobal array index: $_FILES[$filesKey][&#039;error&#039;][0]. Check that the array index exists before using it.

WARNINGSecurityNonce verification recommended351
Category
Security
Occurrences
351
Severity
warning

Sample message

Processing form data without nonce verification.

ERRORI18nMissing Arg Domain298
Category
I18n
Occurrences
298
Severity
error

Sample message

Missing $domain parameter in function call to __().

ERRORSecurityDatabase parameter is not escaped153
Category
Security
Occurrences
153
Severity
error

Sample message

Unescaped parameter $WpUserId used in $wpdb->get_var()\n$WpUserId assigned unsafely at line 288.

ERRORSecuritySQL query is not prepared147
Category
Security
Occurrences
147
Severity
error

Sample message

Use placeholders and $wpdb->prepare(); found $WhereValues

ERRORMaintainabilityfile system operations fclose126
Category
Maintainability
Occurrences
126
Severity
error

Sample message

File operations should use WP_Filesystem methods instead of direct PHP filesystem calls. Found: fclose().

ERRORMaintainabilitydate date110
Category
Maintainability
Occurrences
110
Severity
error

Sample message

date() is affected by runtime timezone changes which can cause date/time to be incorrectly displayed. Use gmdate() instead.

ERRORMaintainabilityfile system operations fopen110
Category
Maintainability
Occurrences
110
Severity
error

Sample message

File operations should use WP_Filesystem methods instead of direct PHP filesystem calls. Found: fopen().

ERRORMaintainabilitycurl curl setopt103
Category
Maintainability
Occurrences
103
Severity
error

Sample message

Using cURL functions is highly discouraged. Use wp_remote_get() instead.

ERRORMaintainabilityunlink unlink74
Category
Maintainability
Occurrences
74
Severity
error

Sample message

unlink() is discouraged. Use wp_delete_file() to delete a file.

External Connections

Potential connections found in static code analysis.

68 domains

Outbound calls

184

External assets

9

Incoming endpoints

101

Notable Domains

contest-gallery.com25 · outbound
stackoverflow.com17 · outbound
api.stripe.com12 · outbound
youtube.com10 · outbound
platform.openai.com7 · outbound

Platform / Reference Domains

schema.org8 · platform/reference
w3.org4 · platform/reference
codex.wordpress.org1 · platform/reference
developer.wordpress.org1 · platform/reference
github.com1 · platform/reference
make.wordpress.org1 · platform/reference
s.w.org1 · platform/reference

External Asset Domains

google.com9 · asset + outbound
accounts.google.com3 · asset + outbound
code.jquery.com3 · asset
js.stripe.com1 · asset

Incoming Endpoints

/wp-json/contest-gallery-network/v1/verifyREST

register_rest_route

wp_ajax_nopriv_cg_show_set_comments_v10public

wp_ajax

wp_ajax_nopriv_post_cg_changes_recognizedpublic

wp_ajax

wp_ajax_nopriv_post_cg_check_if_onlinepublic

wp_ajax

wp_ajax_nopriv_post_cg_ecommerce_payment_processingpublic

wp_ajax

wp_ajax_nopriv_post_cg_galleries_show_cg_gallerypublic

wp_ajax

Admin AJAX endpoints73
wp_ajax_post_cg1l_get_gallery_dataauthenticated

wp_ajax

admin_post_cg_network_exportauthenticated

admin_post

wp_ajax_cg_check_wp_admin_upload_v10authenticated

wp_ajax

wp_ajax_cg_show_set_comments_v10authenticated

wp_ajax

wp_ajax_post_cg_add_openai_imageauthenticated

wp_ajax

wp_ajax_post_cg_attach_to_another_userauthenticated

wp_ajax

wp_ajax_post_cg_attach_to_another_user_selectauthenticated

wp_ajax

wp_ajax_post_cg_backend_gallery_user_filter_optionsauthenticated

wp_ajax

wp_ajax_post_cg_backend_image_uploadauthenticated

wp_ajax

wp_ajax_post_cg_change_invoiceauthenticated

wp_ajax

wp_ajax_post_cg_changes_recognizedauthenticated

wp_ajax

wp_ajax_post_cg_check_if_onlineauthenticated

wp_ajax

61 more hidden

Score History

First score snapshot

v30.0.4

23

Latest

Findings
35,952
Errors
9,310
Warnings
26,642
Check
2.0.0

Relationship Map

Author, categories, issues, domains, and nearby plugins.

37 nodes

Related Plugins