Best WordPress file manager without FTP access. Edit code with built-in editor, upload files, download plugins, download themes, manage wp directory, …
Category Scores
Top Issues by Category
maintainability444
security350
Issues Details
956 issues found in latest scan
$_GET['code'] not unslashed before sanitization. Use wp_unslash() or similar
Global variables defined by a theme/plugin should start with the theme/plugin prefix. Found: "$actionLinks".
File operations should use WP_Filesystem methods instead of direct PHP filesystem calls. Found: fclose().
Detected usage of a non-sanitized input variable: $_FILES['content']['tmp_name']
All output should be run through an escaping function (like esc_html_e() or esc_attr_e()), found '_e'.
Function "esc_textarea()" requires WordPress 3.1.0, but your plugin minimum supported version is WordPress 3.0.0.
Processing form data without nonce verification.
Mismatched text domain. Expected 'filester' but got 'filebird'.
File operations should use WP_Filesystem methods instead of direct PHP filesystem calls. Found: fopen().
Detected usage of a possibly undefined superglobal array index: $_FILES['content']['tmp_name']. Check that the array index exists before using it.
Using cURL functions is highly discouraged. Use wp_remote_get() instead.
File operations should use WP_Filesystem methods instead of direct PHP filesystem calls. Found: is_writable().
All output should be run through an escaping function (see the Security sections in the WordPress Developer Handbooks), found '$ermsg'.
File operations should use WP_Filesystem methods instead of direct PHP filesystem calls. Found: fread().
error_reporting() can lead to full path disclosure.
File operations should use WP_Filesystem methods instead of direct PHP filesystem calls. Found: mkdir().
All output should be run through an escaping function (see the Security sections in the WordPress Developer Handbooks), found '$e'.
Using cURL functions is highly discouraged. Use wp_remote_get() instead.
Using cURL functions is highly discouraged. Use wp_remote_get() instead.
Processing form data without nonce verification.
File operations should use WP_Filesystem methods instead of direct PHP filesystem calls. Found: touch().
File operations should use WP_Filesystem methods instead of direct PHP filesystem calls. Found: chmod().
rename() is discouraged. Use WP_Filesystem::move() to rename a file.
Resource version not set in call to wp_enqueue_script(). This means new versions of the script may not always be loaded due to browser caching.
| Code | Type | Message | Count |
|---|---|---|---|
| WordPress.Security.ValidatedSanitizedInput.MissingUnslash | WARNING | $_GET['code'] not unslashed before sanitization. Use wp_unslash() or similar | 90 |
| WordPress.NamingConventions.PrefixAllGlobals.NonPrefixedVariableFound | WARNING | Global variables defined by a theme/plugin should start with the theme/plugin prefix. Found: "$actionLinks". | 63 |
| WordPress.WP.AlternativeFunctions.file_system_operations_fclose | ERROR | File operations should use WP_Filesystem methods instead of direct PHP filesystem calls. Found: fclose(). | 60 |
| WordPress.Security.ValidatedSanitizedInput.InputNotSanitized | WARNING | Detected usage of a non-sanitized input variable: $_FILES['content']['tmp_name'] | 58 |
| WordPress.Security.EscapeOutput.UnsafePrintingFunction | ERROR | All output should be run through an escaping function (like esc_html_e() or esc_attr_e()), found '_e'. | 55 |
| wp_function_not_compatible_with_requires_wp | ERROR | Function "esc_textarea()" requires WordPress 3.1.0, but your plugin minimum supported version is WordPress 3.0.0. | 55 |
| WordPress.Security.NonceVerification.Recommended | WARNING | Processing form data without nonce verification. | 49 |
| WordPress.WP.I18n.TextDomainMismatch | ERROR | Mismatched text domain. Expected 'filester' but got 'filebird'. | 45 |
| WordPress.WP.AlternativeFunctions.file_system_operations_fopen | ERROR | File operations should use WP_Filesystem methods instead of direct PHP filesystem calls. Found: fopen(). | 43 |
| WordPress.Security.ValidatedSanitizedInput.InputNotValidated | WARNING | Detected usage of a possibly undefined superglobal array index: $_FILES['content']['tmp_name']. Check that the array index exists before using it. | 39 |
| WordPress.WP.AlternativeFunctions.curl_curl_setopt | ERROR | Using cURL functions is highly discouraged. Use wp_remote_get() instead. | 39 |
| WordPress.WP.AlternativeFunctions.file_system_operations_is_writable | ERROR | File operations should use WP_Filesystem methods instead of direct PHP filesystem calls. Found: is_writable(). | 30 |
| WordPress.Security.EscapeOutput.OutputNotEscaped | ERROR | All output should be run through an escaping function (see the Security sections in the WordPress Developer Handbooks), found '$ermsg'. | 28 |
| WordPress.WP.AlternativeFunctions.file_system_operations_fread | ERROR | File operations should use WP_Filesystem methods instead of direct PHP filesystem calls. Found: fread(). | 27 |
| WordPress.PHP.DevelopmentFunctions.prevent_path_disclosure_error_reporting | WARNING | error_reporting() can lead to full path disclosure. | 19 |
| WordPress.WP.AlternativeFunctions.file_system_operations_mkdir | ERROR | File operations should use WP_Filesystem methods instead of direct PHP filesystem calls. Found: mkdir(). | 19 |
| WordPress.Security.EscapeOutput.ExceptionNotEscaped | ERROR | All output should be run through an escaping function (see the Security sections in the WordPress Developer Handbooks), found '$e'. | 17 |
| WordPress.WP.AlternativeFunctions.curl_curl_init | ERROR | Using cURL functions is highly discouraged. Use wp_remote_get() instead. | 16 |
| WordPress.WP.AlternativeFunctions.curl_curl_setopt_array | ERROR | Using cURL functions is highly discouraged. Use wp_remote_get() instead. | 16 |
| WordPress.Security.NonceVerification.Missing | WARNING | Processing form data without nonce verification. | 14 |
| WordPress.WP.AlternativeFunctions.file_system_operations_touch | ERROR | File operations should use WP_Filesystem methods instead of direct PHP filesystem calls. Found: touch(). | 14 |
| WordPress.WP.AlternativeFunctions.file_system_operations_chmod | ERROR | File operations should use WP_Filesystem methods instead of direct PHP filesystem calls. Found: chmod(). | 12 |
| WordPress.WP.AlternativeFunctions.rename_rename | ERROR | rename() is discouraged. Use WP_Filesystem::move() to rename a file. | 11 |
| WordPress.WP.EnqueuedResourceParameters.MissingVersion | WARNING | Resource version not set in call to wp_enqueue_script(). This means new versions of the script may not always be loaded due to browser caching. | 11 |
| Squiz.PHP.DiscouragedFunctions.Discouraged | WARNING | The use of function ini_set() is discouraged | 9 |
Latest Snapshot
Findings
956
Errors
565
Warnings
391
Score History
First score snapshot
First scan completed Jun 20, 2026
v2.1.1 · Plugin Check 2.0.0 · Model 2026.06-mvp-static-v2
Jun 20, 2026
v2.1.1
22
Latest
- Findings
- 956
- Errors
- 565
- Warnings
- 391
- Plugin Check
- 2.0.0
- Model
- 2026.06-mvp-static-v2
| Scan | Score | Findings | Errors | Warnings | Plugin | Plugin Check | Model |
|---|---|---|---|---|---|---|---|
| Jun 20, 2026Latest | 22 | 956 | 565 | 391 | v2.1.1 | 2.0.0 | 2026.06-mvp-static-v2 |
