Display Tweets is an easy to use, future proof Twitter feed plugin that uses PHP to make requests to the v1.1 Twitter REST API.
29
Score
135
Errors
135
Warnings
+0
Change
Category Scores
Security0
Repo76
Performance100
Maintainability38
Issues to Review
Prioritized issue groups from the latest Plugin Check scan
Maintainability
121
14 issue groups
Security
100
9 issue groups
I18n
39
2 issue groups
WARNINGMaintainabilityNon-prefixed global variableGlobal variables defined by a theme/plugin should start with the theme/plugin prefix. Found: "$access_token".69
- Category
- Maintainability
- Occurrences
- 69
- Severity
- warning
Sample message
Global variables defined by a theme/plugin should start with the theme/plugin prefix. Found: "$access_token".
ERRORI18nText Domain MismatchMismatched text domain. Expected 'display-tweets-php' but got 'displaytweets'.37
- Category
- I18n
- Occurrences
- 37
- Severity
- error
Sample message
Mismatched text domain. Expected 'display-tweets-php' but got 'displaytweets'.
ERRORSecurityUnsafe printing functionAll output should be run through an escaping function (like esc_html_e() or esc_attr_e()), found '_e'.29
- Category
- Security
- Occurrences
- 29
- Severity
- error
Sample message
All output should be run through an escaping function (like esc_html_e() or esc_attr_e()), found '_e'.
ERRORSecurityOutput is not escapedAll output should be run through an escaping function (see the Security sections in the WordPress Developer Handbooks), found '"<p>{$this->format_tweet( $tweet->text )}<br /><small class=\"muted\">- {$posted_since}</small></p>"'.25
- Category
- Security
- Occurrences
- 25
- Severity
- error
Sample message
All output should be run through an escaping function (see the Security sections in the WordPress Developer Handbooks), found '"<p>{$this->format_tweet( $tweet->text )}<br /><small class=\"muted\">- {$posted_since}</small></p>"'.
WARNINGMaintainabilityNon-prefixed classClasses declared by a theme/plugin should start with the theme/plugin prefix. Found: "DT_Widget".13
- Category
- Maintainability
- Occurrences
- 13
- Severity
- warning
Sample message
Classes declared by a theme/plugin should start with the theme/plugin prefix. Found: "DT_Widget".
WARNINGSecurityInput is not sanitizedDetected usage of a non-sanitized input variable: $_ENV['CONTENT_TYPE']13
- Category
- Security
- Occurrences
- 13
- Severity
- warning
Sample message
Detected usage of a non-sanitized input variable: $_ENV['CONTENT_TYPE']
ERRORMaintainabilitycurl curl setoptUsing cURL functions is highly discouraged. Use wp_remote_get() instead.12
- Category
- Maintainability
- Occurrences
- 12
- Severity
- error
Sample message
Using cURL functions is highly discouraged. Use wp_remote_get() instead.
WARNINGSecurityInput is not validatedDetected usage of a possibly undefined superglobal array index: $_REQUEST['oauth_verifier']. Check that the array index exists before using it.9
- Category
- Security
- Occurrences
- 9
- Severity
- warning
Sample message
Detected usage of a possibly undefined superglobal array index: $_REQUEST['oauth_verifier']. Check that the array index exists before using it.
ERRORMaintainabilityMissing direct file access protectionPHP file should prevent direct access. Add a check like: if ( ! defined( 'ABSPATH' ) ) exit;9
- Category
- Maintainability
- Occurrences
- 9
- Severity
- error
Sample message
PHP file should prevent direct access. Add a check like: if ( ! defined( 'ABSPATH' ) ) exit;
WARNINGSecurityRequest data is not unslashed$_POST['settings'] not unslashed before sanitization. Use wp_unslash() or similar8
- Category
- Security
- Occurrences
- 8
- Severity
- warning
Sample message
$_POST['settings'] not unslashed before sanitization. Use wp_unslash() or similar
Show 15 moreShow less
ERRORSecurityException output is not escaped6
- Category
- Security
- Occurrences
- 6
- Severity
- error
Sample message
All output should be run through an escaping function (see the Security sections in the WordPress Developer Handbooks), found '"Expired timestamp, yours $timestamp, ours $now"'.
WARNINGSecurityNonce verification recommended5
- Category
- Security
- Occurrences
- 5
- Severity
- warning
Sample message
Processing form data without nonce verification.
WARNINGSecurityInput is not validated or sanitized4
- Category
- Security
- Occurrences
- 4
- Severity
- warning
Sample message
Detected usage of a non-sanitized, non-validated input variable _GET: "displaytweets-save_{$_GET['page']}"
WARNINGMaintainabilityNon-prefixed constant3
- Category
- Maintainability
- Occurrences
- 3
- Severity
- warning
Sample message
Global constants defined by a theme/plugin should start with the theme/plugin prefix. Found: "CONSUMER_KEY".
WARNINGMaintainabilitytrademarked term3
- Category
- Maintainability
- Occurrences
- 3
- Severity
- warning
Sample message
The plugin name includes a restricted term. Your chosen plugin name - "Display Tweets" - contains the restricted term "tweet" which cannot be used at all in your plugin name.
ERRORMaintainabilityForbidden PHP function found2
- Category
- Maintainability
- Occurrences
- 2
- Severity
- error
Sample message
The use of function create_function() is forbidden
WARNINGMaintainabilityNon-prefixed function2
- Category
- Maintainability
- Occurrences
- 2
- Severity
- warning
Sample message
Functions declared in the global namespace by a theme/plugin should start with the theme/plugin prefix. Found: "twitteroauth_header".
WARNINGMaintainabilityerror log print r2
- Category
- Maintainability
- Occurrences
- 2
- Severity
- warning
Sample message
print_r() found. Debug code should not normally be used in production.
ERRORMaintainabilitycurl curl getinfo2
- Category
- Maintainability
- Occurrences
- 2
- Severity
- error
Sample message
Using cURL functions is highly discouraged. Use wp_remote_get() instead.
ERRORI18nNon Singular String Literal Text2
- Category
- I18n
- Occurrences
- 2
- Severity
- error
Sample message
The $text parameter must be a single text string literal. Found: 'Twitter\'s v1.1 API requires authentication. For this you need to <a href="'. self::$registration_url .'">register an application here</a>. Follow the instructions and that\'s it, you\'re authenticated.'
WARNINGMaintainabilityDirect Query1
- Category
- Maintainability
- Occurrences
- 1
- Severity
- warning
Sample message
Use of a direct database call is discouraged.
WARNINGMaintainabilityNo Caching1
- Category
- Maintainability
- Occurrences
- 1
- Severity
- warning
Sample message
Direct database call without caching detected. Consider using wp_cache_get() / wp_cache_set() or wp_cache_delete().
ERRORSecuritySQL query is not prepared1
- Category
- Security
- Occurrences
- 1
- Severity
- error
Sample message
Use placeholders and $wpdb->prepare(); found $query
ERRORMaintainabilitydate date1
- Category
- Maintainability
- Occurrences
- 1
- Severity
- error
Sample message
date() is affected by runtime timezone changes which can cause date/time to be incorrectly displayed. Use gmdate() instead.
ERRORMaintainabilitytimezone change date default timezone set1
- Category
- Maintainability
- Occurrences
- 1
- Severity
- error
Sample message
Using date_default_timezone_set() and similar isn't allowed, instead use WP internal timezone support.
External Connections
Potential connections found in static code analysis.
Outbound calls
20
External assets
0
Incoming endpoints
0
Notable Domains
api.twitter.com5 · outbound
twitter.com5 · outbound
matthewruddy.com2 · outbound
abrah.am1 · outbound
dev.twitter.com1 · outbound
oauth.net1 · outbound
Platform / Reference Domains
External Asset Domains
No external asset domains detected.
Incoming Endpoints
No public endpoints detected.
Score History
First score snapshot
v1.0.3
29
Latest
- Findings
- 270
- Errors
- 135
- Warnings
- 135
- Check
- 2.0.0
| Scan | Score | Findings | Errors | Warnings | Plugin | Check |
|---|---|---|---|---|---|---|
| Latest | 29 | 270 | 135 | 135 | v1.0.3 | 2.0.0 |
Relationship Map
Author, categories, issues, domains, and nearby plugins.
Loading map
PluginAuthorCategoryIssueDomainRelated
Relationship links
Plugin
Author
Issue
Domain
Related
WebSub (FKA. PubSubHubbub)98 scoreYoast SEO – Advanced SEO with real-time guidance and built-in AI24 scoreContact Form 769 scoreElementor Website Builder – more than just a page builder39 scoreLiteSpeed Cache35 scoreWooCommerce21 scoreAkismet Anti-spam: Spam Protection35 scoreSite Kit by Google – Analytics, Search Console, AdSense, Speed25 scoreWordfence Security – Firewall, Malware Scan, and Login Security21 scoreJetpack – WP Security, Backup, Speed, & Growth22 scoreReally Simple Security – Simple and Performant Security (formerly Really Simple SSL)19 scoreAdvanced Custom Fields (ACF®)23 scoreGN Publisher: Google News Compatible RSS Feeds90 scoreRSS for Yandex Turbo32 score
Plugin
Author
Issue
Domain
Related
WebSub (FKA. PubSubHubbub)98 scoreYoast SEO – Advanced SEO with real-time guidance and built-in AI24 scoreContact Form 769 scoreElementor Website Builder – more than just a page builder39 scoreLiteSpeed Cache35 scoreWooCommerce21 scoreAkismet Anti-spam: Spam Protection35 scoreSite Kit by Google – Analytics, Search Console, AdSense, Speed25 scoreWordfence Security – Firewall, Malware Scan, and Login Security21 scoreJetpack – WP Security, Backup, Speed, & Growth22 scoreReally Simple Security – Simple and Performant Security (formerly Really Simple SSL)19 scoreAdvanced Custom Fields (ACF®)23 scoreGN Publisher: Google News Compatible RSS Feeds90 scoreRSS for Yandex Turbo32 score
Related Plugins
Add Featured Image to RSS Feed
2k+ active installs
100
WebSub (FKA. PubSubHubbub)
100k+ active installs
98
Send Images to RSS
3k+ active installs
98
WP Telegram Widget and Join Link
4k+ active installs
95
MB ImageChimp RSS Feed Enhancer
700 active installs
92
Widgets for Social Post Feed
400 active installs
91