Leyka is a plugin for crowdfunding and donations collection via WordPress website.
Category Scores
Issues to Review
Prioritized issue groups from the latest Plugin Check scan
Security
2,485
9 issue groups
Maintainability
962
12 issue groups
I18n
200
4 issue groups
WARNINGSecurityRequest data is not unslashed$_COOKIE[$name] not unslashed before sanitization. Use wp_unslash() or similar570
- Category
- Security
- Occurrences
- 570
- Severity
- warning
Sample message
$_COOKIE[$name] not unslashed before sanitization. Use wp_unslash() or similar
WARNINGSecurityMissing nonce verificationProcessing form data without nonce verification.564
- Category
- Security
- Occurrences
- 564
- Severity
- warning
Sample message
Processing form data without nonce verification.
WARNINGSecurityNonce verification recommendedProcessing form data without nonce verification.554
- Category
- Security
- Occurrences
- 554
- Severity
- warning
Sample message
Processing form data without nonce verification.
WARNINGMaintainabilityNon-prefixed global variableGlobal variables defined by a theme/plugin should start with the theme/plugin prefix. Found: "$activation_status".548
- Category
- Maintainability
- Occurrences
- 548
- Severity
- warning
Sample message
Global variables defined by a theme/plugin should start with the theme/plugin prefix. Found: "$activation_status".
WARNINGSecurityInput is not sanitizedDetected usage of a non-sanitized input variable: $_COOKIE[$name]544
- Category
- Security
- Occurrences
- 544
- Severity
- warning
Sample message
Detected usage of a non-sanitized input variable: $_COOKIE[$name]
WARNINGSecurityInput is not validatedDetected usage of a possibly undefined superglobal array index: $_GET['PayerID']. Check that the array index exists before using it.187
- Category
- Security
- Occurrences
- 187
- Severity
- warning
Sample message
Detected usage of a possibly undefined superglobal array index: $_GET['PayerID']. Check that the array index exists before using it.
ERRORI18nMissing Translators CommentA function call to __() with texts containing placeholders was found, but was not accompanied by a "translators:" comment on the line above to clarify the meaning of the placeholders.140
- Category
- I18n
- Occurrences
- 140
- Severity
- error
Sample message
A function call to __() with texts containing placeholders was found, but was not accompanied by a "translators:" comment on the line above to clarify the meaning of the placeholders.
WARNINGMaintainabilityerror log print rprint_r() found. Debug code should not normally be used in production.92
- Category
- Maintainability
- Occurrences
- 92
- Severity
- warning
Sample message
print_r() found. Debug code should not normally be used in production.
WARNINGMaintainabilityDirect QueryUse of a direct database call is discouraged.91
- Category
- Maintainability
- Occurrences
- 91
- Severity
- warning
Sample message
Use of a direct database call is discouraged.
WARNINGMaintainabilityNo CachingDirect database call without caching detected. Consider using wp_cache_get() / wp_cache_set() or wp_cache_delete().85
- Category
- Maintainability
- Occurrences
- 85
- Severity
- warning
Sample message
Direct database call without caching detected. Consider using wp_cache_get() / wp_cache_set() or wp_cache_delete().
Show 15 moreShow less
ERRORI18nMissing Arg Domain33
- Category
- I18n
- Occurrences
- 33
- Severity
- error
Sample message
Missing $domain parameter in function call to __().
WARNINGMaintainabilityDiscouraged PHP function32
- Category
- Maintainability
- Occurrences
- 32
- Severity
- warning
Sample message
The use of function ini_set() is discouraged
WARNINGMaintainabilityslow db query meta key32
- Category
- Maintainability
- Occurrences
- 32
- Severity
- warning
Sample message
Detected usage of meta_key, possible slow query.
WARNINGSecuritywp redirect wp redirect26
- Category
- Security
- Occurrences
- 26
- Severity
- warning
Sample message
wp_redirect() found. Using wp_safe_redirect(), along with the "allowed_redirect_hosts" filter if needed, can help avoid any chances of malicious redirects within code. It is also important to remember to call exit() after a redirect so that no other unwanted code is executed.
WARNINGMaintainabilityNon-prefixed hook name19
- Category
- Maintainability
- Occurrences
- 19
- Severity
- warning
Sample message
Hook names invoked by a theme/plugin should start with the theme/plugin prefix. Found: "agree_to_pd_terms_text_link_part".
ERRORSecuritySQL query is not prepared18
- Category
- Security
- Occurrences
- 18
- Severity
- error
Sample message
Use placeholders and $wpdb->prepare(); found $curr_interval_donations
ERRORMaintainabilityMissing direct file access protection18
- Category
- Maintainability
- Occurrences
- 18
- Severity
- error
Sample message
PHP file should prevent direct access. Add a check like: if ( ! defined( 'ABSPATH' ) ) exit;
WARNINGMaintainabilityslow db query meta query16
- Category
- Maintainability
- Occurrences
- 16
- Severity
- warning
Sample message
Detected usage of meta_query, possible slow query.
ERRORI18nUnordered Placeholders Text15
- Category
- I18n
- Occurrences
- 15
- Severity
- error
Sample message
Multiple placeholders in translatable strings should be ordered. Expected "%1$d, %2$d, %3$d", but got "%d, %d, %d" in 'The value should be max. %d characters length (currently: <span class="leyka-field-current-value-length">%d</span> / %d)'.
ERRORI18nNon Singular String Literal Text12
- Category
- I18n
- Occurrences
- 12
- Severity
- error
Sample message
The $text parameter must be a single text string literal. Found: $default_template['name']
ERRORSecurityDatabase parameter is not escaped11
- Category
- Security
- Occurrences
- 11
- Severity
- error
Sample message
Unescaped parameter $donations_post_type used in $wpdb->get_results()\n$donations_post_type assigned unsafely at line 128.
WARNINGSecurityInterpolated SQL is not prepared11
- Category
- Security
- Occurrences
- 11
- Severity
- warning
Sample message
Use placeholders and $wpdb->prepare(); found interpolated variable $query_joins at "SELECT COUNT(DISTINCT meta.meta_value) FROM {$wpdb->prefix}postmeta meta $query_joins WHERE $query_where"
WARNINGMaintainabilityerror log error log11
- Category
- Maintainability
- Occurrences
- 11
- Severity
- warning
Sample message
error_log() found. Debug code should not normally be used in production.
WARNINGMaintainabilityslow db query meta value9
- Category
- Maintainability
- Occurrences
- 9
- Severity
- warning
Sample message
Detected usage of meta_value, possible slow query.
WARNINGMaintainabilityNon-prefixed function9
- Category
- Maintainability
- Occurrences
- 9
- Severity
- warning
Sample message
Functions declared in the global namespace by a theme/plugin should start with the theme/plugin prefix. Found: "error_log_yandex_phyz".
External Connections
Not analyzed yet.
Score History
First score snapshot
v3.32.2
22
Latest
- Findings
- 3,698
- Errors
- 253
- Warnings
- 3,445
- Check
- 2.0.0
| Scan | Score | Findings | Errors | Warnings | Plugin | Check |
|---|---|---|---|---|---|---|
| Latest | 22 | 3,698 | 253 | 3,445 | v3.32.2 | 2.0.0 |
Relationship Map
Author, categories, issues, domains, and nearby plugins.