Very customizable plugin to list posts by category (or tag, author and more) in a post, page or widget. Uses the [catlist] shortcode to select posts.
37
Score
161
Errors
17
Warnings
+1
Change
Category Scores
Security0
Repo94
Performance92
Maintainability68
Issues to Review
Prioritized issue groups from the latest Plugin Check scan
Security
111
6 issue groups
Maintainability
54
10 issue groups
Performance
7
2 issue groups
I18n
5
3 issue groups
ERRORSecurityOutput is not escapedAll output should be run through an escaping function (see the Security sections in the WordPress Developer Handbooks), found '$after_title'.62
- Category
- Security
- Occurrences
- 62
- Severity
- error
Sample message
All output should be run through an escaping function (see the Security sections in the WordPress Developer Handbooks), found '$after_title'.
ERRORSecurityUnsafe printing functionAll output should be run through an escaping function (like esc_html_e() or esc_attr_e()), found '_e'.41
- Category
- Security
- Occurrences
- 41
- Severity
- error
Sample message
All output should be run through an escaping function (like esc_html_e() or esc_attr_e()), found '_e'.
ERRORMaintainabilitystrip tags strip tagsstrip_tags() is discouraged. Use the more comprehensive wp_strip_all_tags() instead.37
- Category
- Maintainability
- Occurrences
- 37
- Severity
- error
Sample message
strip_tags() is discouraged. Use the more comprehensive wp_strip_all_tags() instead.
ERRORMaintainabilityMissing direct file access protectionPHP file should prevent direct access. Add a check like: if ( ! defined( 'ABSPATH' ) ) exit;9
- Category
- Maintainability
- Occurrences
- 9
- Severity
- error
Sample message
PHP file should prevent direct access. Add a check like: if ( ! defined( 'ABSPATH' ) ) exit;
WARNINGPerformancePost Not In excludeUsing exclusionary parameters, like exclude, in calls to get_posts() should be done with caution, see https://wpvip.com/documentation/performance-improvements-by-removing-usage-of-post__not_in/ for more information.6
- Category
- Performance
- Occurrences
- 6
- Severity
- warning
Sample message
Using exclusionary parameters, like exclude, in calls to get_posts() should be done with caution, see https://wpvip.com/documentation/performance-improvements-by-removing-usage-of-post__not_in/ for more information.
ERRORSecuritySetting is missing a sanitization callbackSanitization missing for register_setting().4
- Category
- Security
- Occurrences
- 4
- Severity
- error
Sample message
Sanitization missing for register_setting().
WARNINGSecurityInterpolated SQL is not preparedUse placeholders and $wpdb->prepare(); found interpolated variable {$collate} at "{$wp_posts}.post_title COLLATE {$collate} LIKE %s"2
- Category
- Security
- Occurrences
- 2
- Severity
- warning
Sample message
Use placeholders and $wpdb->prepare(); found interpolated variable {$collate} at "{$wp_posts}.post_title COLLATE {$collate} LIKE %s"
ERRORI18nMissing Arg DomainMissing $domain parameter in function call to __().2
- Category
- I18n
- Occurrences
- 2
- Severity
- error
Sample message
Missing $domain parameter in function call to __().
ERRORI18nNon Singular String Literal TextThe $text parameter must be a single text string literal. Found: $value2
- Category
- I18n
- Occurrences
- 2
- Severity
- error
Sample message
The $text parameter must be a single text string literal. Found: $value
WARNINGMaintainabilityslow db query meta queryDetected usage of meta_query, possible slow query.1
- Category
- Maintainability
- Occurrences
- 1
- Severity
- warning
Sample message
Detected usage of meta_query, possible slow query.
Show 12 moreShow less
WARNINGMaintainabilityslow db query tax query1
- Category
- Maintainability
- Occurrences
- 1
- Severity
- warning
Sample message
Detected usage of tax_query, possible slow query.
ERRORMaintainabilitydate date1
- Category
- Maintainability
- Occurrences
- 1
- Severity
- error
Sample message
date() is affected by runtime timezone changes which can cause date/time to be incorrectly displayed. Use gmdate() instead.
WARNINGSecurityInput is not sanitized1
- Category
- Security
- Occurrences
- 1
- Severity
- warning
Sample message
Detected usage of a non-sanitized input variable: $_SERVER['QUERY_STRING']
WARNINGSecurityRequest data is not unslashed1
- Category
- Security
- Occurrences
- 1
- Severity
- warning
Sample message
$_SERVER['QUERY_STRING'] not unslashed before sanitization. Use wp_unslash() or similar
WARNINGMaintainabilityDiscouraged PHP function1
- Category
- Maintainability
- Occurrences
- 1
- Severity
- warning
Sample message
query_posts() is discouraged. Use WP_Query instead.
WARNINGMaintainabilityDiscouraged PHP function1
- Category
- Maintainability
- Occurrences
- 1
- Severity
- warning
Sample message
wp_reset_query() is discouraged. Use wp_reset_postdata() instead.
WARNINGMaintainabilityMissing Version1
- Category
- Maintainability
- Occurrences
- 1
- Severity
- warning
Sample message
Resource version not set in call to wp_enqueue_style(). This means new versions of the style may not always be loaded due to browser caching.
ERRORI18nToo Many Function Args1
- Category
- I18n
- Occurrences
- 1
- Severity
- error
Sample message
Too many parameters passed to function "_e()". Expected: 2 parameters, received: 3
WARNINGPerformancePost Not In post not in1
- Category
- Performance
- Occurrences
- 1
- Severity
- warning
Sample message
Using exclusionary parameters, like post__not_in, in calls to get_posts() should be done with caution, see https://wpvip.com/documentation/performance-improvements-by-removing-usage-of-post__not_in/ for more information.
ERRORRepo Complianceplugin header no license1
- Category
- Repo Compliance
- Occurrences
- 1
- Severity
- error
Sample message
Missing "License" in Plugin Header. Please update your Plugin Header with a valid GPLv2 (or later) compatible license.
WARNINGMaintainabilityupgrade notice limit1
- Category
- Maintainability
- Occurrences
- 1
- Severity
- warning
Sample message
The upgrade notice for "0.34" exceeds the limit of 300 characters.
ERRORMaintainabilitywp function not compatible with requires wp1
- Category
- Maintainability
- Occurrences
- 1
- Severity
- error
Sample message
Function "mb_strlen()" requires WordPress 4.2.0, but your plugin minimum supported version is WordPress 3.3.0.
External Connections
Potential connections found in static code analysis.
Outbound calls
28
External assets
0
Incoming endpoints
0
Notable Domains
picandocodigo.net5 · outbound
amazon.com2 · outbound
eric.clst.org1 · outbound
fernandobriano.com1 · outbound
gist.github.com1 · outbound
i.ytimg.com1 · outbound
Platform / Reference Domains
github.com5 · platform/reference
codex.wordpress.org4 · platform/reference
wordpress.org4 · platform/reference
core.trac.wordpress.org1 · platform/reference
developer.wordpress.org1 · platform/reference
External Asset Domains
No external asset domains detected.
Incoming Endpoints
No public endpoints detected.
Score History
2 score snapshots
v0.96.0
37
Latest
- Findings
- 178
- Errors
- 161
- Warnings
- 17
- Check
- 2.0.0
v0.95.0
36
Score
- Findings
- 179
- Errors
- 162
- Warnings
- 17
- Check
- 2.0.0
| Scan | Score | Findings | Errors | Warnings | Plugin | Check |
|---|---|---|---|---|---|---|
| Latest | 37 | 178 | 161 | 17 | v0.96.0 | 2.0.0 |
| 36 | 179 | 162 | 17 | v0.95.0 | 2.0.0 |
Relationship Map
Author, categories, issues, domains, and nearby plugins.
Loading map
PluginAuthorCategoryIssueDomainRelated
Relationship links
Author
Issue
Domain
Related
Classic Editor63 scoreWooCommerce21 scoreYoast SEO – Advanced SEO with real-time guidance and built-in AI24 scoreAkismet Anti-spam: Spam Protection35 scoreAll-in-One WP Migration and Backup34 scoreSite Kit by Google – Analytics, Search Console, AdSense, Speed25 scoreWordfence Security – Firewall, Malware Scan, and Login Security21 scoreDuplicate Page40 scoreReally Simple Security – Simple and Performant Security (formerly Really Simple SSL)19 scoreWordPress Importer25 scoreGenerateBlocks97 scorePost Duplicator60 scoreWhite Label CMS33 scorePublic Post Preview57 score
Author
Issue
Domain
Related
Classic Editor63 scoreWooCommerce21 scoreYoast SEO – Advanced SEO with real-time guidance and built-in AI24 scoreAkismet Anti-spam: Spam Protection35 scoreAll-in-One WP Migration and Backup34 scoreSite Kit by Google – Analytics, Search Console, AdSense, Speed25 scoreWordfence Security – Firewall, Malware Scan, and Login Security21 scoreDuplicate Page40 scoreReally Simple Security – Simple and Performant Security (formerly Really Simple SSL)19 scoreWordPress Importer25 scoreGenerateBlocks97 scorePost Duplicator60 scoreWhite Label CMS33 scorePublic Post Preview57 score
Related Plugins
Post Tags and Categories for Pages
20k+ active installs
99
Essential Widgets
10k+ active installs
99
Allow HTML in Category Descriptions
8k+ active installs
99
Default Post Author
1k+ active installs
99
Super List Block
800 active installs
99
List all posts by Authors, nested Categories and Titles
600 active installs
99