A simpler, faster, and smarter WordPress forms plugin.
36
Score
223
Errors
163
Warnings
+0
Change
Category Scores
Security0
Repo100
Performance100
Maintainability57
Issues to Review
Prioritized issue groups from the latest Plugin Check scan
Security
295
10 issue groups
Maintainability
45
12 issue groups
I18n
41
3 issue groups
ERRORSecurityOutput is not escapedAll output should be run through an escaping function (see the Security sections in the WordPress Developer Handbooks), found '$class'.82
- Category
- Security
- Occurrences
- 82
- Severity
- error
Sample message
All output should be run through an escaping function (see the Security sections in the WordPress Developer Handbooks), found '$class'.
ERRORSecurityUnsafe printing functionAll output should be run through an escaping function (like esc_html_e() or esc_attr_e()), found '_e'.79
- Category
- Security
- Occurrences
- 79
- Severity
- error
Sample message
All output should be run through an escaping function (like esc_html_e() or esc_attr_e()), found '_e'.
WARNINGSecurityNonce verification recommendedProcessing form data without nonce verification.52
- Category
- Security
- Occurrences
- 52
- Severity
- warning
Sample message
Processing form data without nonce verification.
WARNINGSecurityRequest data is not unslashed$_GET[$key] not unslashed before sanitization. Use wp_unslash() or similar28
- Category
- Security
- Occurrences
- 28
- Severity
- warning
Sample message
$_GET[$key] not unslashed before sanitization. Use wp_unslash() or similar
ERRORI18nMissing Arg DomainMissing $domain parameter in function call to __().24
- Category
- I18n
- Occurrences
- 24
- Severity
- error
Sample message
Missing $domain parameter in function call to __().
WARNINGSecurityInput is not sanitizedDetected usage of a non-sanitized input variable: $_GET[$key]22
- Category
- Security
- Occurrences
- 22
- Severity
- warning
Sample message
Detected usage of a non-sanitized input variable: $_GET[$key]
ERRORI18nMissing Translators CommentA function call to __() with texts containing placeholders was found, but was not accompanied by a "translators:" comment on the line above to clarify the meaning of the placeholders.13
- Category
- I18n
- Occurrences
- 13
- Severity
- error
Sample message
A function call to __() with texts containing placeholders was found, but was not accompanied by a "translators:" comment on the line above to clarify the meaning of the placeholders.
ERRORMaintainabilityMissing direct file access protectionPHP file should prevent direct access. Add a check like: if ( ! defined( 'ABSPATH' ) ) exit;11
- Category
- Maintainability
- Occurrences
- 11
- Severity
- error
Sample message
PHP file should prevent direct access. Add a check like: if ( ! defined( 'ABSPATH' ) ) exit;
WARNINGMaintainabilityDirect QueryUse of a direct database call is discouraged.10
- Category
- Maintainability
- Occurrences
- 10
- Severity
- warning
Sample message
Use of a direct database call is discouraged.
WARNINGMaintainabilityNo CachingDirect database call without caching detected. Consider using wp_cache_get() / wp_cache_set() or wp_cache_delete().9
- Category
- Maintainability
- Occurrences
- 9
- Severity
- warning
Sample message
Direct database call without caching detected. Consider using wp_cache_get() / wp_cache_set() or wp_cache_delete().
Show 15 moreShow less
WARNINGSecurityInterpolated SQL is not prepared9
- Category
- Security
- Occurrences
- 9
- Severity
- warning
Sample message
Use placeholders and $wpdb->prepare(); found interpolated variable {$charset_collate} at ) {$charset_collate};"
WARNINGSecurityMissing nonce verification9
- Category
- Security
- Occurrences
- 9
- Severity
- warning
Sample message
Processing form data without nonce verification.
WARNINGSecurityDatabase parameter is not escaped7
- Category
- Security
- Occurrences
- 7
- Severity
- warning
Sample message
Unescaped parameter $table used in $wpdb->get_results()\n$table assigned unsafely at line 101.
WARNINGSecurityInput is not validated6
- Category
- Security
- Occurrences
- 6
- Severity
- warning
Sample message
Detected usage of a possibly undefined superglobal array index: $_GET['form_id']. Check that the array index exists before using it.
ERRORI18nNon Singular String Literal Text4
- Category
- I18n
- Occurrences
- 4
- Severity
- error
Sample message
The $text parameter must be a single text string literal. Found: add_query_arg( array( 'paged' => $current_page + 1 ) )
ERRORMaintainabilitystrip tags strip tags3
- Category
- Maintainability
- Occurrences
- 3
- Severity
- error
Sample message
strip_tags() is discouraged. Use the more comprehensive wp_strip_all_tags() instead.
WARNINGMaintainabilitySchema Change2
- Category
- Maintainability
- Occurrences
- 2
- Severity
- warning
Sample message
Attempting a database schema change is discouraged.
ERRORMaintainabilitydate date2
- Category
- Maintainability
- Occurrences
- 2
- Severity
- error
Sample message
date() is affected by runtime timezone changes which can cause date/time to be incorrectly displayed. Use gmdate() instead.
WARNINGMaintainabilityMissing Version2
- Category
- Maintainability
- Occurrences
- 2
- Severity
- warning
Sample message
Resource version not set in call to wp_enqueue_script(). This means new versions of the script may not always be loaded due to browser caching.
ERRORMaintainabilitywp function not compatible with requires wp2
- Category
- Maintainability
- Occurrences
- 2
- Severity
- error
Sample message
Function "register_block_type()" requires WordPress 5.0.0, but your plugin minimum supported version is WordPress 4.6.0.
WARNINGMaintainabilityNo PHP code found1
- Category
- Maintainability
- Occurrences
- 1
- Severity
- warning
Sample message
No PHP code was found in this file and short open tags are not allowed by this install of PHP. This file may be using short open tags but PHP does not allow them.
WARNINGSecurityUnfinished Prepare1
- Category
- Security
- Occurrences
- 1
- Severity
- warning
Sample message
Replacement variables found, but no valid placeholders found in the query.
WARNINGMaintainabilityerror log error log1
- Category
- Maintainability
- Occurrences
- 1
- Severity
- warning
Sample message
error_log() found. Debug code should not normally be used in production.
ERRORMaintainabilityparse url parse url1
- Category
- Maintainability
- Occurrences
- 1
- Severity
- error
Sample message
parse_url() is discouraged because of inconsistency in the output across PHP versions; use wp_parse_url() instead.
WARNINGMaintainabilityNot In Footer1
- Category
- Maintainability
- Occurrences
- 1
- Severity
- warning
Sample message
In footer ($in_footer) is not set explicitly wp_enqueue_script; It is recommended to load scripts in the footer. Please set this value to `true` to load it in the footer, or explicitly `false` if it should be loaded in the header.
External Connections
Potential connections found in static code analysis.
Outbound calls
43
External assets
1
Incoming endpoints
3
Notable Domains
htmlformsplugin.com24 · outbound
php-fig.org2 · outbound
chimpbridge.com1 · outbound
getcomposer.org1 · outbound
removewcfeatures.com1 · outbound
termsplugin.com1 · outbound
Platform / Reference Domains
w3.org5 · platform/reference
github.com2 · platform/reference
gnu.org1 · platform/reference
wordpress.org1 · platform/reference
External Asset Domains
google.com4 · asset + outbound
Incoming Endpoints
wp_ajax_nopriv_hf_form_submitpublic
wp_ajax
Admin AJAX endpoints2
wp_ajax_hf_dismiss_recaptcha_noticeauthenticated
wp_ajax
wp_ajax_hf_form_submitauthenticated
wp_ajax
Score History
2 score snapshots
v1.6.5
36
Latest
- Findings
- 386
- Errors
- 223
- Warnings
- 163
- Check
- 2.0.0
v1.6.4
36
Score
- Findings
- 397
- Errors
- 231
- Warnings
- 166
- Check
- 2.0.0
| Scan | Score | Findings | Errors | Warnings | Plugin | Check |
|---|---|---|---|---|---|---|
| Latest | 36 | 386 | 223 | 163 | v1.6.5 | 2.0.0 |
| 36 | 397 | 231 | 166 | v1.6.4 | 2.0.0 |
Relationship Map
Author, categories, issues, domains, and nearby plugins.
Loading map
PluginAuthorCategoryIssueDomainRelated
Relationship links
Author
Issue
Domain
Related
Akismet Anti-spam: Spam Protection35 scoreClassic Editor63 scoreWooCommerce21 scoreYoast SEO – Advanced SEO with real-time guidance and built-in AI24 scoreAll-in-One WP Migration and Backup34 scoreSite Kit by Google – Analytics, Search Console, AdSense, Speed25 scoreWordfence Security – Firewall, Malware Scan, and Login Security21 scoreDuplicate Page40 scoreReally Simple Security – Simple and Performant Security (formerly Really Simple SSL)19 scoreWordPress Importer25 scoreContact Form 769 scoreWPForms – AI Form Builder for WordPress – Contact Forms, Payment Forms, Survey Form, Quiz & More31 scoreMC4WP: Mailchimp for WordPress57 scoreFluent Forms – Customizable Contact Forms, Survey, Quiz, & Conversational Form Builder23 score
Author
Issue
Domain
Related
Akismet Anti-spam: Spam Protection35 scoreClassic Editor63 scoreWooCommerce21 scoreYoast SEO – Advanced SEO with real-time guidance and built-in AI24 scoreAll-in-One WP Migration and Backup34 scoreSite Kit by Google – Analytics, Search Console, AdSense, Speed25 scoreWordfence Security – Firewall, Malware Scan, and Login Security21 scoreDuplicate Page40 scoreReally Simple Security – Simple and Performant Security (formerly Really Simple SSL)19 scoreWordPress Importer25 scoreContact Form 769 scoreWPForms – AI Form Builder for WordPress – Contact Forms, Payment Forms, Survey Form, Quiz & More31 scoreMC4WP: Mailchimp for WordPress57 scoreFluent Forms – Customizable Contact Forms, Survey, Quiz, & Conversational Form Builder23 score
Related Plugins
Add Password Field for Contact Form 7
3k+ active installs
100
SurveyX Builder – Easy Feedback, Poll, Quiz & Survey
2k+ active installs
100
Contact Form Query
1k+ active installs
100
Style Contact Form 7
1k+ active installs
100
Contact Forms by Cimatti
600 active installs
100
ACF Field For CF7
10k+ active installs
99