GetPaid > Wallet

Allows users to topup and withdraw money from their wallet while also being able to use their balance at checkout.

v2.0.13StiofanUpdated Added 700 installs0% rating
36
Score
149
Errors
174
Warnings
+0
Change

Category Scores

Security0
Repo89
Performance100
Maintainability61

Issues to Review

Prioritized issue groups from the latest Plugin Check scan

323 findings

Security

128

12 issue groups

I18n

116

4 issue groups

Maintainability

74

9 issue groups

ERRORI18nText Domain MismatchMismatched text domain. Expected 'getpaid-wallet' but got 'tgmpa'.95
Category
I18n
Occurrences
95
Severity
error

Sample message

Mismatched text domain. Expected 'getpaid-wallet' but got 'tgmpa'.

WARNINGSecurityNonce verification recommendedProcessing form data without nonce verification.36
Category
Security
Occurrences
36
Severity
warning

Sample message

Processing form data without nonce verification.

WARNINGSecurityInterpolated SQL is not preparedUse placeholders and $wpdb->prepare(); found interpolated variable $offset at "SELECT * FROM $table ORDER BY $orderby $order LIMIT $offset, 10"25
Category
Security
Occurrences
25
Severity
warning

Sample message

Use placeholders and $wpdb->prepare(); found interpolated variable $offset at "SELECT * FROM $table ORDER BY $orderby $order LIMIT $offset, 10"

WARNINGMaintainabilityDirect QueryUse of a direct database call is discouraged.23
Category
Maintainability
Occurrences
23
Severity
warning

Sample message

Use of a direct database call is discouraged.

WARNINGMaintainabilityNo CachingDirect database call without caching detected. Consider using wp_cache_get() / wp_cache_set() or wp_cache_delete().21
Category
Maintainability
Occurrences
21
Severity
warning

Sample message

Direct database call without caching detected. Consider using wp_cache_get() / wp_cache_set() or wp_cache_delete().

WARNINGSecurityRequest data is not unslashed$_GET['date_from'] not unslashed before sanitization. Use wp_unslash() or similar18
Category
Security
Occurrences
18
Severity
warning

Sample message

$_GET['date_from'] not unslashed before sanitization. Use wp_unslash() or similar

ERRORI18nMissing Translators CommentA function call to __() with texts containing placeholders was found, but was not accompanied by a "translators:" comment on the line above to clarify the meaning of the placeholders.17
Category
I18n
Occurrences
17
Severity
error

Sample message

A function call to __() with texts containing placeholders was found, but was not accompanied by a "translators:" comment on the line above to clarify the meaning of the placeholders.

ERRORSecurityOutput is not escapedAll output should be run through an escaping function (see the Security sections in the WordPress Developer Handbooks), found '$id'.16
Category
Security
Occurrences
16
Severity
error

Sample message

All output should be run through an escaping function (see the Security sections in the WordPress Developer Handbooks), found '$id'.

WARNINGMaintainabilityNon-prefixed global variableGlobal variables defined by a theme/plugin should start with the theme/plugin prefix. Found: "$body_id".13
Category
Maintainability
Occurrences
13
Severity
warning

Sample message

Global variables defined by a theme/plugin should start with the theme/plugin prefix. Found: "$body_id".

WARNINGSecurityInput is not sanitizedDetected usage of a non-sanitized input variable: $_GET['plugin']8
Category
Security
Occurrences
8
Severity
warning

Sample message

Detected usage of a non-sanitized input variable: $_GET['plugin']

Show 15 more
WARNINGSecurityDatabase parameter is not escaped6
Category
Security
Occurrences
6
Severity
warning

Sample message

Unescaped parameter $orderby used in $wpdb->get_results()\n$orderby assigned unsafely at line 163.

WARNINGMaintainabilityNo PHP code found5
Category
Maintainability
Occurrences
5
Severity
warning

Sample message

No PHP code was found in this file and short open tags are not allowed by this install of PHP. This file may be using short open tags but PHP does not allow them.

ERRORSecurityDatabase parameter is not escaped5
Category
Security
Occurrences
5
Severity
error

Sample message

Unescaped parameter $offset used in $wpdb->get_results()\n$offset assigned unsafely at line 81.

ERRORSecuritySQL query is not prepared4
Category
Security
Occurrences
4
Severity
error

Sample message

Use placeholders and $wpdb->prepare(); found $sql

WARNINGMaintainabilityNon-prefixed hook name4
Category
Maintainability
Occurrences
4
Severity
warning

Sample message

Hook names invoked by a theme/plugin should start with the theme/plugin prefix. Found: "manage_wpinv_wallet_transactions_bulk_actions".

ERRORSecurityUnsafe printing function4
Category
Security
Occurrences
4
Severity
error

Sample message

All output should be run through an escaping function (like esc_html_e() or esc_attr_e()), found '_e'.

WARNINGSecurityMissing nonce verification4
Category
Security
Occurrences
4
Severity
warning

Sample message

Processing form data without nonce verification.

WARNINGMaintainabilityNon-prefixed class3
Category
Maintainability
Occurrences
3
Severity
warning

Sample message

Classes declared by a theme/plugin should start with the theme/plugin prefix. Found: "TGM_Bulk_Installer".

ERRORI18nNon Singular String Literal Text3
Category
I18n
Occurrences
3
Severity
error

Sample message

The $text parameter must be a single text string literal. Found: stripslashes( $args['before_balance'] )

WARNINGMaintainabilitySchema Change2
Category
Maintainability
Occurrences
2
Severity
warning

Sample message

Attempting a database schema change is discouraged.

ERRORMaintainabilityMissing direct file access protection2
Category
Maintainability
Occurrences
2
Severity
error

Sample message

PHP file should prevent direct access. Add a check like: if ( ! defined( 'ABSPATH' ) ) exit;

WARNINGI18nDiscouraged text-domain loading1
Category
I18n
Occurrences
1
Severity
warning

Sample message

load_plugin_textdomain() has been discouraged since WordPress version 4.6. When your plugin is hosted on WordPress.org, you no longer need to manually include this function call for translations under your plugin slug. WordPress will automatically load the translations for you as needed.

WARNINGSecurityReplacements Wrong Number1
Category
Security
Occurrences
1
Severity
warning

Sample message

Incorrect number of replacements passed to $wpdb->prepare(). Found 1 replacement parameters, expected 2.

WARNINGSecurityUnfinished Prepare1
Category
Security
Occurrences
1
Severity
warning

Sample message

Replacement variables found, but no valid placeholders found in the query.

ERRORMaintainabilitydate date1
Category
Maintainability
Occurrences
1
Severity
error

Sample message

date() is affected by runtime timezone changes which can cause date/time to be incorrectly displayed. Use gmdate() instead.

External Connections

Potential connections found in static code analysis.

17 domains

Outbound calls

95

External assets

0

Incoming endpoints

1

Notable Domains

tools.ietf.org48 · outbound
developer.paypal.com14 · outbound
en.wikipedia.org7 · outbound
paypal.com3 · outbound
php.net3 · outbound

Platform / Reference Domains

core.trac.wordpress.org3 · platform/reference
github.com2 · platform/reference
developer.wordpress.org1 · platform/reference
gnu.org1 · platform/reference

External Asset Domains

No external asset domains detected.

Incoming Endpoints

No public endpoints detected.

Admin AJAX endpoints1
wp_ajax_wpinv_wallet_withdrawauthenticated

wp_ajax

Score History

First score snapshot

v2.0.13

36

Latest

Findings
323
Errors
149
Warnings
174
Check
2.0.0

Relationship Map

Author, categories, issues, domains, and nearby plugins.

36 nodes

Related Plugins