ERP: Complete HR, Recruitment, Accounting & CRM Suite with WooCommerce CRM Support

Self-hosted ERP for WordPress with HR, CRM, accounting, and recruitment. Run your business from one dashboard and keep your data yours.

v1.17.5weDevsUpdated Added 5k+ installs88% rating
21
Score
829
Errors
5,966
Warnings
+0
Change

Category Scores

Security0
Repo76
Performance96
Maintainability0

Issues to Review

Prioritized issue groups from the latest Plugin Check scan

6,795 findings

Maintainability

4,826

11 issue groups

Security

1,631

11 issue groups

I18n

229

3 issue groups

WARNINGMaintainabilityDirect QueryUse of a direct database call is discouraged.1,033
Category
Maintainability
Occurrences
1,033
Severity
warning

Sample message

Use of a direct database call is discouraged.

WARNINGMaintainabilityNon-prefixed functionFunctions declared in the global namespace by a theme/plugin should start with the theme/plugin prefix. Found: "acct_send_email".928
Category
Maintainability
Occurrences
928
Severity
warning

Sample message

Functions declared in the global namespace by a theme/plugin should start with the theme/plugin prefix. Found: "acct_send_email".

WARNINGMaintainabilityNon-prefixed global variableGlobal variables defined by a theme/plugin should start with the theme/plugin prefix. Found: "$_18_to_25".884
Category
Maintainability
Occurrences
884
Severity
warning

Sample message

Global variables defined by a theme/plugin should start with the theme/plugin prefix. Found: "$_18_to_25".

WARNINGMaintainabilityNo CachingDirect database call without caching detected. Consider using wp_cache_get() / wp_cache_set() or wp_cache_delete().797
Category
Maintainability
Occurrences
797
Severity
warning

Sample message

Direct database call without caching detected. Consider using wp_cache_get() / wp_cache_set() or wp_cache_delete().

WARNINGSecurityNonce verification recommendedProcessing form data without nonce verification.712
Category
Security
Occurrences
712
Severity
warning

Sample message

Processing form data without nonce verification.

WARNINGMaintainabilityNon-prefixed hook nameHook names invoked by a theme/plugin should start with the theme/plugin prefix. Found: "'erp_ac_settings_section_fields_' . $this->id".571
Category
Maintainability
Occurrences
571
Severity
warning

Sample message

Hook names invoked by a theme/plugin should start with the theme/plugin prefix. Found: "'erp_ac_settings_section_fields_' . $this->id".

WARNINGSecurityMissing nonce verificationProcessing form data without nonce verification.398
Category
Security
Occurrences
398
Severity
warning

Sample message

Processing form data without nonce verification.

ERRORMaintainabilityMissing direct file access protectionPHP file should prevent direct access. Add a check like: if ( ! defined( 'ABSPATH' ) ) exit;398
Category
Maintainability
Occurrences
398
Severity
error

Sample message

PHP file should prevent direct access. Add a check like: if ( ! defined( 'ABSPATH' ) ) exit;

WARNINGSecurityInterpolated SQL is not preparedUse placeholders and $wpdb->prepare(); found interpolated variable $add_or at "$field $search_condition %s $add_or"200
Category
Security
Occurrences
200
Severity
warning

Sample message

Use placeholders and $wpdb->prepare(); found interpolated variable $add_or at "$field $search_condition %s $add_or"

ERRORI18nMissing Translators CommentA function call to __() with texts containing placeholders was found, but was not accompanied by a "translators:" comment on the line above to clarify the meaning of the placeholders.191
Category
I18n
Occurrences
191
Severity
error

Sample message

A function call to __() with texts containing placeholders was found, but was not accompanied by a "translators:" comment on the line above to clarify the meaning of the placeholders.

Show 15 more
WARNINGSecurityDatabase parameter is not escaped166
Category
Security
Occurrences
166
Severity
warning

Sample message

Unescaped parameter $activity_tb used in $wpdb->get_col()\n$activity_tb assigned unsafely at line 30.

WARNINGMaintainabilitySchema Change63
Category
Maintainability
Occurrences
63
Severity
warning

Sample message

Attempting a database schema change is discouraged.

ERRORMaintainabilitydate date62
Category
Maintainability
Occurrences
62
Severity
error

Sample message

date() is affected by runtime timezone changes which can cause date/time to be incorrectly displayed. Use gmdate() instead.

ERRORMaintainabilityrand mt rand53
Category
Maintainability
Occurrences
53
Severity
error

Sample message

mt_rand() is discouraged. Use the far less predictable wp_rand() instead.

WARNINGSecuritywp redirect wp redirect38
Category
Security
Occurrences
38
Severity
warning

Sample message

wp_redirect() found. Using wp_safe_redirect(), along with the "allowed_redirect_hosts" filter if needed, can help avoid any chances of malicious redirects within code. It is also important to remember to call exit() after a redirect so that no other unwanted code is executed.

WARNINGSecurityInput is not sanitized26
Category
Security
Occurrences
26
Severity
warning

Sample message

Detected usage of a non-sanitized input variable: $_GET['filter_leave_status']

WARNINGSecurityRequest data is not unslashed24
Category
Security
Occurrences
24
Severity
warning

Sample message

$_GET['filter_leave_status'] not unslashed before sanitization. Use wp_unslash() or similar

ERRORI18nInterpolated Variable Text22
Category
I18n
Occurrences
22
Severity
error

Sample message

The $text parameter must not contain interpolated variables or expressions. Found: {$field_name}

WARNINGSecurityUnnecessary Prepare21
Category
Security
Occurrences
21
Severity
warning

Sample message

It is not necessary to prepare a query which doesn't use variable replacement.

WARNINGMaintainabilityerror log error log20
Category
Maintainability
Occurrences
20
Severity
warning

Sample message

error_log() found. Debug code should not normally be used in production.

ERRORSecurityDatabase parameter is not escaped18
Category
Security
Occurrences
18
Severity
error

Sample message

Unescaped parameter $column used in $wpdb->get_row()\n$column assigned unsafely at line 260.

WARNINGMaintainabilityerror log print r17
Category
Maintainability
Occurrences
17
Severity
warning

Sample message

print_r() found. Debug code should not normally be used in production.

ERRORI18nUnordered Placeholders Text16
Category
I18n
Occurrences
16
Severity
error

Sample message

Multiple placeholders in translatable strings should be ordered. Expected "%1$1s, %2$2s", but got "%1s, %2s" in '<strong>%1s</strong> created a note for <strong>%2s</strong>'.

ERRORSecurityOutput is not escaped14
Category
Security
Occurrences
14
Severity
error

Sample message

All output should be run through an escaping function (see the Security sections in the WordPress Developer Handbooks), found '"⚠️ Already patched: $method\n"'.

WARNINGSecurityInput is not validated14
Category
Security
Occurrences
14
Severity
warning

Sample message

Detected usage of a possibly undefined superglobal array index: $_FILES[&#039;ics&#039;][&#039;type&#039;]. Check that the array index exists before using it.

External Connections

Not analyzed yet.

Score History

First score snapshot

v1.17.5

21

Latest

Findings
6,795
Errors
829
Warnings
5,966
Check
2.0.0

Relationship Map

Author, categories, issues, domains, and nearby plugins.

29 nodes

Related Plugins

LeadConnector

20k+ active installs

100
Contact Form to Any API

8k+ active installs

97
Gravity Forms Klaviyo Add-On

1k+ active installs

96
Simla.com

400 active installs

95