PluginScore

RSS Redirect & Feedburner Alternative

Free Feedburner Alternative and RSS Redirect plugin from follow.it.

v4.4s-feedsUpdated Added 1k+ installs98% rating
feedfeedburnerfeedsrsss-feeds
26
Score
277
Errors
272
Warnings
+0
Change

Category Scores

Security0
Repo94
Performance100
Maintainability11

Issues to Review

Prioritized issue groups from the latest Plugin Check scan

549 findings

Security

324

11 issue groups

Maintainability

201

13 issue groups

I18n

9

1 issue group

ERRORSecurityOutput is not escapedAll output should be run through an escaping function (see the Security sections in the WordPress Developer Handbooks), found '$SFMWid'.161
Category
Security
Occurrences
161
Severity
error

Sample message

All output should be run through an escaping function (see the Security sections in the WordPress Developer Handbooks), found '$SFMWid'.

WordPress.Security.EscapeOutput.OutputNotEscapedReference
WARNINGMaintainabilityNon-prefixed global variableGlobal variables defined by a theme/plugin should start with the theme/plugin prefix. Found: "$CustomFdata".67
Category
Maintainability
Occurrences
67
Severity
warning

Sample message

Global variables defined by a theme/plugin should start with the theme/plugin prefix. Found: "$CustomFdata".

WordPress.NamingConventions.PrefixAllGlobals.NonPrefixedVariableFound
ERRORSecuritySQL query is not preparedUse placeholders and $wpdb->prepare(); found $_POST38
Category
Security
Occurrences
38
Severity
error

Sample message

Use placeholders and $wpdb->prepare(); found $_POST

WordPress.DB.PreparedSQL.NotPrepared
WARNINGSecurityRequest data is not unslashed$_GET['page'] not unslashed before sanitization. Use wp_unslash() or similar33
Category
Security
Occurrences
33
Severity
warning

Sample message

$_GET['page'] not unslashed before sanitization. Use wp_unslash() or similar

WordPress.Security.ValidatedSanitizedInput.MissingUnslash
WARNINGMaintainabilityDirect QueryUse of a direct database call is discouraged.26
Category
Maintainability
Occurrences
26
Severity
warning

Sample message

Use of a direct database call is discouraged.

WordPress.DB.DirectDatabaseQuery.DirectQuery
WARNINGMaintainabilityNo CachingDirect database call without caching detected. Consider using wp_cache_get() / wp_cache_set() or wp_cache_delete().25
Category
Maintainability
Occurrences
25
Severity
warning

Sample message

Direct database call without caching detected. Consider using wp_cache_get() / wp_cache_set() or wp_cache_delete().

WordPress.DB.DirectDatabaseQuery.NoCaching
WARNINGSecurityInput is not validatedDetected usage of a possibly undefined superglobal array index: $_GET['page']. Check that the array index exists before using it.22
Category
Security
Occurrences
22
Severity
warning

Sample message

Detected usage of a possibly undefined superglobal array index: $_GET['page']. Check that the array index exists before using it.

WordPress.Security.ValidatedSanitizedInput.InputNotValidated
ERRORMaintainabilitywp function not compatible with requires wpFunction "current_action()" requires WordPress 3.9.0, but your plugin minimum supported version is WordPress 3.0.0.22
Category
Maintainability
Occurrences
22
Severity
error

Sample message

Function "current_action()" requires WordPress 3.9.0, but your plugin minimum supported version is WordPress 3.0.0.

wp_function_not_compatible_with_requires_wpReference
WARNINGSecurityDatabase parameter is not escapedUnescaped parameter $table used in $wpdb->get_row()\n$table assigned unsafely at line 227.16
Category
Security
Occurrences
16
Severity
warning

Sample message

Unescaped parameter $table used in $wpdb->get_row()\n$table assigned unsafely at line 227.

PluginCheck.Security.DirectDB.UnescapedDBParameter
ERRORMaintainabilityMissing direct file access protectionPHP file should prevent direct access. Add a check like: if ( ! defined( 'ABSPATH' ) ) exit;14
Category
Maintainability
Occurrences
14
Severity
error

Sample message

PHP file should prevent direct access. Add a check like: if ( ! defined( 'ABSPATH' ) ) exit;

missing_direct_file_access_protectionReference
Show 15 more
WARNINGMaintainabilityNon-prefixed function13
Category
Maintainability
Occurrences
13
Severity
warning

Sample message

Functions declared in the global namespace by a theme/plugin should start with the theme/plugin prefix. Found: "SFM_pluginUpdates".

WordPress.NamingConventions.PrefixAllGlobals.NonPrefixedFunctionFound
WARNINGSecurityMissing nonce verification11
Category
Security
Occurrences
11
Severity
warning

Sample message

Processing form data without nonce verification.

WordPress.Security.NonceVerification.Missing
WARNINGSecurityNonce verification recommended11
Category
Security
Occurrences
11
Severity
warning

Sample message

Processing form data without nonce verification.

WordPress.Security.NonceVerification.Recommended
WARNINGSecurityInterpolated SQL is not prepared10
Category
Security
Occurrences
10
Severity
warning

Sample message

Use placeholders and $wpdb->prepare(); found interpolated variable $existence at "SELECT rid, sf_feedid as feed_id, feed_url, feed_subUrl as redirect_url, verification_code as code, redirect_status FROM $table where rid=$existence"

WordPress.DB.PreparedSQL.InterpolatedNotPrepared
WARNINGSecurityInput is not sanitized10
Category
Security
Occurrences
10
Severity
warning

Sample message

Detected usage of a non-sanitized input variable: $_POST['nonce']

WordPress.Security.ValidatedSanitizedInput.InputNotSanitized
ERRORI18nText Domain Mismatch9
Category
I18n
Occurrences
9
Severity
error

Sample message

Mismatched text domain. Expected 'feedburner-alternative-and-rss-redirect' but got 'RSS Redirect '.

WordPress.WP.I18n.TextDomainMismatchReference
WARNINGMaintainabilityNon-prefixed constant7
Category
Maintainability
Occurrences
7
Severity
warning

Sample message

Global constants defined by a theme/plugin should start with the theme/plugin prefix. Found: "SFM_ACTIVE_RSS_CACHE_KEY".

WordPress.NamingConventions.PrefixAllGlobals.NonPrefixedConstantFound
ERRORSecurityUnsafe printing function7
Category
Security
Occurrences
7
Severity
error

Sample message

All output should be run through an escaping function (like esc_html_e() or esc_attr_e()), found '_e'.

WordPress.Security.EscapeOutput.UnsafePrintingFunctionReference
ERRORMaintainabilitystrip tags strip tags7
Category
Maintainability
Occurrences
7
Severity
error

Sample message

strip_tags() is discouraged. Use the more comprehensive wp_strip_all_tags() instead.

WordPress.WP.AlternativeFunctions.strip_tags_strip_tags
WARNINGMaintainabilityMissing Version6
Category
Maintainability
Occurrences
6
Severity
warning

Sample message

Resource version not set in call to wp_enqueue_script(). This means new versions of the script may not always be loaded due to browser caching.

WordPress.WP.EnqueuedResourceParameters.MissingVersion
ERRORSecurityDatabase parameter is not escaped5
Category
Security
Occurrences
5
Severity
error

Sample message

Unescaped parameter $sql used in $wpdb->get_row()\n$sql assigned unsafely at line 64.

PluginCheck.Security.DirectDB.UnescapedDBParameter
WARNINGMaintainabilityNon-prefixed class5
Category
Maintainability
Occurrences
5
Severity
warning

Sample message

Classes declared by a theme/plugin should start with the theme/plugin prefix. Found: "sfmBasicActions".

WordPress.NamingConventions.PrefixAllGlobals.NonPrefixedClassFound
ERRORMaintainabilitydate date4
Category
Maintainability
Occurrences
4
Severity
error

Sample message

date() is affected by runtime timezone changes which can cause date/time to be incorrectly displayed. Use gmdate() instead.

WordPress.DateTime.RestrictedFunctions.date_date
WARNINGMaintainabilitytrademarked term3
Category
Maintainability
Occurrences
3
Severity
warning

Sample message

The plugin name includes a restricted term. Your chosen plugin name - "Feedburner Alternative and RSS Redirect Plugin" - contains the restricted term "feedburner" which cannot be used at all in your plugin name.

trademarked_term
WARNINGMaintainabilitySchema Change2
Category
Maintainability
Occurrences
2
Severity
warning

Sample message

Attempting a database schema change is discouraged.

WordPress.DB.DirectDatabaseQuery.SchemaChange

External Connections

Potential connections found in static code analysis.

19 domains

Outbound calls

72

External assets

1

Incoming endpoints

6

Notable Domains

api.follow.it13 · outbound
sellcodes.com12 · outbound
follow.it7 · outbound
ultimatelysocial.com6 · outbound
backupbliss.com5 · outbound
feedburner.google.com2 · outbound

Platform / Reference Domains

wordpress.org10 · platform/reference
w3.org5 · platform/reference
downloads.wordpress.org1 · platform/reference

External Asset Domains

fonts.googleapis.com1 · asset

Incoming Endpoints

No public endpoints detected.

Admin AJAX endpoints6
wp_ajax_ActRedirectauthenticated

wp_ajax

wp_ajax_analyst_notification_dismissauthenticated

wp_ajax

wp_ajax_inisev_installationauthenticated

wp_ajax

wp_ajax_inisev_installation_widgetauthenticated

wp_ajax

wp_ajax_sfmProcessFeedsauthenticated

wp_ajax

wp_ajax_sfmReverseRedirectauthenticated

wp_ajax

Score History

First score snapshot

v4.4

26

Latest

Findings
549
Errors
277
Warnings
272
Check
2.0.0

Relationship Map

Author, categories, issues, domains, and nearby plugins.

37 nodes

Related Plugins

Disable Feeds WP

10k+ active installs

100
Display Remote Posts Block

800 active installs

100
Add Featured Image to RSS Feed

2k+ active installs

99
Send Images to RSS

3k+ active installs

98
WebSub (FKA. PubSubHubbub)

100k+ active installs

98
RSS Featured Image

2k+ active installs

96