Bulk import and export WordPress users and WooCommerce customers from CSV, including roles, passwords and any custom meta.
24
Score
1,046
Errors
357
Warnings
+0
Change
Category Scores
Security0
Repo97
Performance97
Maintainability0
Issues to Review
Prioritized issue groups from the latest Plugin Check scan
Security
842
11 issue groups
I18n
256
3 issue groups
Maintainability
246
11 issue groups
ERRORSecurityUnsafe printing functionAll output should be run through an escaping function (like esc_html_e() or esc_attr_e()), found '_e'.465
- Category
- Security
- Occurrences
- 465
- Severity
- error
Sample message
All output should be run through an escaping function (like esc_html_e() or esc_attr_e()), found '_e'.
ERRORI18nText Domain MismatchMismatched text domain. Expected 'import-users-from-csv-with-meta' but got 'action-scheduler'.197
- Category
- I18n
- Occurrences
- 197
- Severity
- error
Sample message
Mismatched text domain. Expected 'import-users-from-csv-with-meta' but got 'action-scheduler'.
ERRORSecurityOutput is not escapedAll output should be run through an escaping function (see the Security sections in the WordPress Developer Handbooks), found '"$group is not a name of a group in Customer Area<br/>"'.153
- Category
- Security
- Occurrences
- 153
- Severity
- error
Sample message
All output should be run through an escaping function (see the Security sections in the WordPress Developer Handbooks), found '"$group is not a name of a group in Customer Area<br/>"'.
ERRORSecurityException output is not escapedAll output should be run through an escaping function (see the Security sections in the WordPress Developer Handbooks), found '"The bulk action $action does not have a callback method"'.92
- Category
- Security
- Occurrences
- 92
- Severity
- error
Sample message
All output should be run through an escaping function (see the Security sections in the WordPress Developer Handbooks), found '"The bulk action $action does not have a callback method"'.
WARNINGMaintainabilityDirect QueryUse of a direct database call is discouraged.72
- Category
- Maintainability
- Occurrences
- 72
- Severity
- warning
Sample message
Use of a direct database call is discouraged.
WARNINGMaintainabilityNo CachingDirect database call without caching detected. Consider using wp_cache_get() / wp_cache_set() or wp_cache_delete().61
- Category
- Maintainability
- Occurrences
- 61
- Severity
- warning
Sample message
Direct database call without caching detected. Consider using wp_cache_get() / wp_cache_set() or wp_cache_delete().
ERRORI18nMissing Translators CommentA function call to __() with texts containing placeholders was found, but was not accompanied by a "translators:" comment on the line above to clarify the meaning of the placeholders.53
- Category
- I18n
- Occurrences
- 53
- Severity
- error
Sample message
A function call to __() with texts containing placeholders was found, but was not accompanied by a "translators:" comment on the line above to clarify the meaning of the placeholders.
WARNINGSecurityRequest data is not unslashed$_GET['search'] not unslashed before sanitization. Use wp_unslash() or similar31
- Category
- Security
- Occurrences
- 31
- Severity
- warning
Sample message
$_GET['search'] not unslashed before sanitization. Use wp_unslash() or similar
ERRORMaintainabilitydate datedate() is affected by runtime timezone changes which can cause date/time to be incorrectly displayed. Use gmdate() instead.27
- Category
- Maintainability
- Occurrences
- 27
- Severity
- error
Sample message
date() is affected by runtime timezone changes which can cause date/time to be incorrectly displayed. Use gmdate() instead.
WARNINGMaintainabilityNon-prefixed hook nameHook names invoked by a theme/plugin should start with the theme/plugin prefix. Found: "add_user_to_blog".26
- Category
- Maintainability
- Occurrences
- 26
- Severity
- warning
Sample message
Hook names invoked by a theme/plugin should start with the theme/plugin prefix. Found: "add_user_to_blog".
Show 15 moreShow less
WARNINGSecurityInput is not sanitized25
- Category
- Security
- Occurrences
- 25
- Severity
- warning
Sample message
Detected usage of a non-sanitized input variable: $_FILES['uploadfile']['name']
WARNINGSecurityDatabase parameter is not escaped16
- Category
- Security
- Occurrences
- 16
- Severity
- warning
Sample message
Unescaped parameter $column_name used in $wpdb->get_var()
WARNINGSecurityInput is not validated15
- Category
- Security
- Occurrences
- 15
- Severity
- warning
Sample message
Detected usage of a possibly undefined superglobal array index: $_FILES['uploadfile']['error']. Check that the array index exists before using it.
WARNINGSecurityNonce verification recommended14
- Category
- Security
- Occurrences
- 14
- Severity
- warning
Sample message
Processing form data without nonce verification.
WARNINGSecurityMissing nonce verification13
- Category
- Security
- Occurrences
- 13
- Severity
- warning
Sample message
Processing form data without nonce verification.
WARNINGMaintainabilityNon-prefixed function12
- Category
- Maintainability
- Occurrences
- 12
- Severity
- warning
Sample message
Functions declared in the global namespace by a theme/plugin should start with the theme/plugin prefix. Found: "as_enqueue_async_action".
ERRORSecuritySQL query is not prepared11
- Category
- Security
- Occurrences
- 11
- Severity
- error
Sample message
Use placeholders and $wpdb->prepare(); found $query
WARNINGMaintainabilityNon-prefixed class11
- Category
- Maintainability
- Occurrences
- 11
- Severity
- warning
Sample message
Classes declared by a theme/plugin should start with the theme/plugin prefix. Found: "CronExpression".
WARNINGMaintainabilityDiscouraged PHP function10
- Category
- Maintainability
- Occurrences
- 10
- Severity
- warning
Sample message
The use of function ini_set() is discouraged
WARNINGMaintainabilityNon-prefixed global variable8
- Category
- Maintainability
- Occurrences
- 8
- Severity
- warning
Sample message
Global variables defined by a theme/plugin should start with the theme/plugin prefix. Found: "$errors_totals".
ERRORSecurityDatabase parameter is not escaped7
- Category
- Security
- Occurrences
- 7
- Severity
- error
Sample message
Unescaped parameter $query used in $wpdb->get_results()\n$query assigned unsafely at line 19.
ERRORMaintainabilityMissing direct file access protection7
- Category
- Maintainability
- Occurrences
- 7
- Severity
- error
Sample message
PHP file should prevent direct access. Add a check like: if ( ! defined( 'ABSPATH' ) ) exit;
WARNINGMaintainabilityslow db query meta key6
- Category
- Maintainability
- Occurrences
- 6
- Severity
- warning
Sample message
Detected usage of meta_key, possible slow query.
WARNINGMaintainabilityNot In Footer6
- Category
- Maintainability
- Occurrences
- 6
- Severity
- warning
Sample message
In footer ($in_footer) is not set explicitly wp_enqueue_script; It is recommended to load scripts in the footer. Please set this value to `true` to load it in the footer, or explicitly `false` if it should be loaded in the header.
ERRORI18nUnordered Placeholders Text6
- Category
- I18n
- Occurrences
- 6
- Severity
- error
Sample message
Multiple placeholders in translatable strings should be ordered. Expected "%1$s, %2$s", but got "%s, %s" in 'Problems with user: "%s" does not exist, error: %s'.
External Connections
Potential connections found in static code analysis.
Outbound calls
82
External assets
2
Incoming endpoints
17
Notable Domains
codection.com7 · outbound
import-wp.com7 · outbound
php.net6 · outbound
actionscheduler.org4 · outbound
en.wikipedia.org4 · outbound
patreon.com3 · outbound
Platform / Reference Domains
github.com12 · platform/reference
wordpress.org10 · platform/reference
core.trac.wordpress.org2 · platform/reference
gnu.org2 · platform/reference
codex.wordpress.org1 · platform/reference
es.wordpress.org1 · platform/reference
External Asset Domains
paypalobjects.com4 · asset + outbound
Incoming Endpoints
/wp-json/import-users-from-csv-with-meta/v1/execute-cron/REST
register_rest_route
wp_ajax_nopriv_public
wp_ajax
Admin AJAX endpoints13
wp_ajax_acui_bulk_delete_attachmentauthenticated
wp_ajax
wp_ajax_acui_delete_attachmentauthenticated
wp_ajax
wp_ajax_acui_delete_users_assign_posts_dataauthenticated
wp_ajax
wp_ajax_acui_email_template_selectedauthenticated
wp_ajax
wp_ajax_acui_export_save_settingsauthenticated
wp_ajax
wp_ajax_acui_export_users_csvauthenticated
wp_ajax
wp_ajax_acui_fire_cronauthenticated
wp_ajax
wp_ajax_acui_fire_cron_no_sessionauthenticated
wp_ajax
wp_ajax_acui_force_reset_password_delete_metasauthenticated
wp_ajax
wp_ajax_acui_import_users_batchauthenticated
wp_ajax
wp_ajax_acui_mail_options_remove_attachmentauthenticated
wp_ajax
wp_ajax_acui_refresh_enable_email_templatesauthenticated
wp_ajax
1 more hidden
Score History
12 score snapshots
v2.4.9
24
Latest
- Findings
- 1,403
- Errors
- 1,046
- Warnings
- 357
- Check
- 2.0.0
v2.4.8
24
Score
- Findings
- 1,403
- Errors
- 1,046
- Warnings
- 357
- Check
- 2.0.0
| Scan | Score | Findings | Errors | Warnings | Plugin | Check |
|---|---|---|---|---|---|---|
| Latest | 24 | 1,403 | 1,046 | 357 | v2.4.9 | 2.0.0 |
| 24 | 1,403 | 1,046 | 357 | v2.4.8 | 2.0.0 |
Relationship Map
Author, categories, issues, domains, and nearby plugins.
Loading map
PluginAuthorCategoryIssueDomainRelated
Relationship links
Author
Issue
Domain
Related
Export All URLs99 scoreWordfence Security – Firewall, Malware Scan, and Login Security21 scoreReally Simple Security – Simple and Performant Security (formerly Really Simple SSL)19 scoreYoast SEO – Advanced SEO with real-time guidance and built-in AI24 scoreClassic Editor63 scoreWooCommerce21 scoreLiteSpeed Cache35 scoreSite Kit by Google – Analytics, Search Console, AdSense, Speed25 scoreDuplicate Page40 scoreJetpack – WP Security, Backup, Speed, & Growth22 scoreWordPress Importer25 scoreTablePress – Tables in WordPress made easy25 scoreWP All Import – Drag & Drop Import for CSV, XML, Excel & Google Sheets35 scorewpDataTables – WordPress Data Table, Dynamic Tables & Table Charts Plugin21 score
Author
Issue
Domain
Related
Export All URLs99 scoreWordfence Security – Firewall, Malware Scan, and Login Security21 scoreReally Simple Security – Simple and Performant Security (formerly Really Simple SSL)19 scoreYoast SEO – Advanced SEO with real-time guidance and built-in AI24 scoreClassic Editor63 scoreWooCommerce21 scoreLiteSpeed Cache35 scoreSite Kit by Google – Analytics, Search Console, AdSense, Speed25 scoreDuplicate Page40 scoreJetpack – WP Security, Backup, Speed, & Growth22 scoreWordPress Importer25 scoreTablePress – Tables in WordPress made easy25 scoreWP All Import – Drag & Drop Import for CSV, XML, Excel & Google Sheets35 scorewpDataTables – WordPress Data Table, Dynamic Tables & Table Charts Plugin21 score
Related Plugins
Get Use APIs – JSON Content Importer
5k+ active installs
100
Export All URLs
50k+ active installs
99
Export Media URLs
7k+ active installs
99
Export Users Data CSV
1k+ active installs
99
CSV Importer Plus for ACF
400 active installs
99
WP All Export – User Export Add-On
2k+ active installs
98