Completely plugins Real Estate. Management system which allows you to own and maintain a real estate marketplace, intro website.
Category Scores
Top Issues by Category
maintainability3,702
security1,586
Issues Details
5,589 issues found in latest scan
Global variables defined by a theme/plugin should start with the theme/plugin prefix. Found: "$Essential_Real_Estate".
Hook names invoked by a theme/plugin should start with the theme/plugin prefix. Found: "'ere_access_denied_' . sanitize_title( $type )".
Detected usage of a non-sanitized input variable: $_COOKIE['property_views']
Processing form data without nonce verification.
Processing form data without nonce verification.
Functions declared in the global namespace by a theme/plugin should start with the theme/plugin prefix. Found: "ERE".
Mismatched text domain. Expected 'essential-real-estate' but got 'g5-core'.
Classes declared by a theme/plugin should start with the theme/plugin prefix. Found: "ERE_Activator".
All output should be run through an escaping function (see the Security sections in the WordPress Developer Handbooks), found '$attributes'.
$_GET[$taxonomy] not unslashed before sanitization. Use wp_unslash() or similar
All output should be run through an escaping function (see the Security sections in the WordPress Developer Handbooks), found '"Could not parse list url into parts: $url"'.
Direct database call without caching detected. Consider using wp_cache_get() / wp_cache_set() or wp_cache_delete().
Detected usage of a possibly undefined superglobal array index: $_FILES['ere_upload_file']. Check that the array index exists before using it.
PHP file should prevent direct access. Add a check like: if ( ! defined( 'ABSPATH' ) ) exit;
Detected usage of meta_query, possible slow query.
wp_redirect() found. Using wp_safe_redirect(), along with the "allowed_redirect_hosts" filter if needed, can help avoid any chances of malicious redirects within code. It is also important to remember to call exit() after a redirect so that no other unwanted code is executed.
Detected usage of meta_key, possible slow query.
Global constants defined by a theme/plugin should start with the theme/plugin prefix. Found: "ERE_AJAX_URL".
Function "get_post_timestamp()" requires WordPress 5.3.0, but your plugin minimum supported version is WordPress 4.5.0.
Detected usage of tax_query, possible slow query.
Hook names invoked by a theme/plugin should start with the theme/plugin prefix. Found: "$this->identifier . '_cron_interval'".
Resource version not set in call to wp_enqueue_style(). This means new versions of the style may not always be loaded due to browser caching.
date() is affected by runtime timezone changes which can cause date/time to be incorrectly displayed. Use gmdate() instead.
Use placeholders and $wpdb->prepare(); found interpolated variable {$column} at \t\t\tWHERE {$column} LIKE %s\n
| Code | Type | Message | Count |
|---|---|---|---|
| WordPress.NamingConventions.PrefixAllGlobals.NonPrefixedVariableFound | WARNING | Global variables defined by a theme/plugin should start with the theme/plugin prefix. Found: "$Essential_Real_Estate". | 2,539 |
| WordPress.NamingConventions.PrefixAllGlobals.NonPrefixedHooknameFound | WARNING | Hook names invoked by a theme/plugin should start with the theme/plugin prefix. Found: "'ere_access_denied_' . sanitize_title( $type )". | 544 |
| WordPress.Security.ValidatedSanitizedInput.InputNotSanitized | WARNING | Detected usage of a non-sanitized input variable: $_COOKIE['property_views'] | 527 |
| WordPress.Security.NonceVerification.Recommended | WARNING | Processing form data without nonce verification. | 423 |
| WordPress.Security.NonceVerification.Missing | WARNING | Processing form data without nonce verification. | 273 |
| WordPress.NamingConventions.PrefixAllGlobals.NonPrefixedFunctionFound | WARNING | Functions declared in the global namespace by a theme/plugin should start with the theme/plugin prefix. Found: "ERE". | 256 |
| WordPress.WP.I18n.TextDomainMismatch | ERROR | Mismatched text domain. Expected 'essential-real-estate' but got 'g5-core'. | 254 |
| WordPress.NamingConventions.PrefixAllGlobals.NonPrefixedClassFound | WARNING | Classes declared by a theme/plugin should start with the theme/plugin prefix. Found: "ERE_Activator". | 149 |
| WordPress.Security.EscapeOutput.OutputNotEscaped | ERROR | All output should be run through an escaping function (see the Security sections in the WordPress Developer Handbooks), found '$attributes'. | 139 |
| WordPress.Security.ValidatedSanitizedInput.MissingUnslash | WARNING | $_GET[$taxonomy] not unslashed before sanitization. Use wp_unslash() or similar | 95 |
| WordPress.Security.EscapeOutput.ExceptionNotEscaped | ERROR | All output should be run through an escaping function (see the Security sections in the WordPress Developer Handbooks), found '"Could not parse list url into parts: $url"'. | 57 |
| WordPress.DB.DirectDatabaseQuery.DirectQuery | WARNING | Use of a direct database call is discouraged. | 51 |
| WordPress.DB.DirectDatabaseQuery.NoCaching | WARNING | Direct database call without caching detected. Consider using wp_cache_get() / wp_cache_set() or wp_cache_delete(). | 50 |
| WordPress.Security.ValidatedSanitizedInput.InputNotValidated | WARNING | Detected usage of a possibly undefined superglobal array index: $_FILES['ere_upload_file']. Check that the array index exists before using it. | 50 |
| missing_direct_file_access_protection | ERROR | PHP file should prevent direct access. Add a check like: if ( ! defined( 'ABSPATH' ) ) exit; | 26 |
| WordPress.DB.SlowDBQuery.slow_db_query_meta_query | WARNING | Detected usage of meta_query, possible slow query. | 24 |
| WordPress.Security.SafeRedirect.wp_redirect_wp_redirect | WARNING | wp_redirect() found. Using wp_safe_redirect(), along with the "allowed_redirect_hosts" filter if needed, can help avoid any chances of malicious redirects within code. It is also important to remember to call exit() after a redirect so that no other unwanted code is executed. | 18 |
| WordPress.DB.SlowDBQuery.slow_db_query_meta_key | WARNING | Detected usage of meta_key, possible slow query. | 15 |
| WordPress.NamingConventions.PrefixAllGlobals.NonPrefixedConstantFound | WARNING | Global constants defined by a theme/plugin should start with the theme/plugin prefix. Found: "ERE_AJAX_URL". | 12 |
| wp_function_not_compatible_with_requires_wp | ERROR | Function "get_post_timestamp()" requires WordPress 5.3.0, but your plugin minimum supported version is WordPress 4.5.0. | 11 |
| WordPress.DB.SlowDBQuery.slow_db_query_tax_query | WARNING | Detected usage of tax_query, possible slow query. | 7 |
| WordPress.NamingConventions.PrefixAllGlobals.DynamicHooknameFound | WARNING | Hook names invoked by a theme/plugin should start with the theme/plugin prefix. Found: "$this->identifier . '_cron_interval'". | 7 |
| WordPress.WP.EnqueuedResourceParameters.MissingVersion | WARNING | Resource version not set in call to wp_enqueue_style(). This means new versions of the style may not always be loaded due to browser caching. | 6 |
| WordPress.DateTime.RestrictedFunctions.date_date | ERROR | date() is affected by runtime timezone changes which can cause date/time to be incorrectly displayed. Use gmdate() instead. | 5 |
| WordPress.DB.PreparedSQL.InterpolatedNotPrepared | WARNING | Use placeholders and $wpdb->prepare(); found interpolated variable {$column} at \t\t\tWHERE {$column} LIKE %s\n | 4 |
Latest Snapshot
Findings
5,589
Errors
529
Warnings
5,060
Score History
First score snapshot
First scan completed Jun 20, 2026
v5.3.3 · Plugin Check 2.0.0 · Model 2026.06-mvp-static-v2
Jun 20, 2026
v5.3.3
23
Latest
- Findings
- 5,589
- Errors
- 529
- Warnings
- 5,060
- Plugin Check
- 2.0.0
- Model
- 2026.06-mvp-static-v2
| Scan | Score | Findings | Errors | Warnings | Plugin | Plugin Check | Model |
|---|---|---|---|---|---|---|---|
| Jun 20, 2026Latest | 23 | 5,589 | 529 | 5,060 | v5.3.3 | 2.0.0 | 2026.06-mvp-static-v2 |