IDX and MLS plugin for WordPress. Import and sync real estate listings from 800+ MLS via the RESO Web API, on any theme.
24
Score
167
Errors
628
Warnings
-3
Change
Category Scores
Security0
Repo90
Performance98
Maintainability4
Issues to Review
Prioritized issue groups from the latest Plugin Check scan
Maintainability
417
11 issue groups
Security
326
13 issue groups
I18n
28
1 issue group
WARNINGMaintainabilityNon-prefixed global variableGlobal variables defined by a theme/plugin should start with the theme/plugin prefix. Found: "$active_tab".310
- Category
- Maintainability
- Occurrences
- 310
- Severity
- warning
Sample message
Global variables defined by a theme/plugin should start with the theme/plugin prefix. Found: "$active_tab".
ERRORSecurityUnsafe printing functionAll output should be run through an escaping function (like esc_html_e() or esc_attr_e()), found '_e'.63
- Category
- Security
- Occurrences
- 63
- Severity
- error
Sample message
All output should be run through an escaping function (like esc_html_e() or esc_attr_e()), found '_e'.
WARNINGSecurityRequest data is not unslashed$_GET['mlsimport_alpha'] not unslashed before sanitization. Use wp_unslash() or similar55
- Category
- Security
- Occurrences
- 55
- Severity
- warning
Sample message
$_GET['mlsimport_alpha'] not unslashed before sanitization. Use wp_unslash() or similar
WARNINGSecurityNonce verification recommendedProcessing form data without nonce verification.48
- Category
- Security
- Occurrences
- 48
- Severity
- warning
Sample message
Processing form data without nonce verification.
WARNINGSecurityInput is not sanitizedDetected usage of a non-sanitized input variable: $_GET['plugin']43
- Category
- Security
- Occurrences
- 43
- Severity
- warning
Sample message
Detected usage of a non-sanitized input variable: $_GET['plugin']
ERRORSecurityOutput is not escapedAll output should be run through an escaping function (see the Security sections in the WordPress Developer Handbooks), found '$current_page'.41
- Category
- Security
- Occurrences
- 41
- Severity
- error
Sample message
All output should be run through an escaping function (see the Security sections in the WordPress Developer Handbooks), found '$current_page'.
WARNINGMaintainabilityDirect QueryUse of a direct database call is discouraged.32
- Category
- Maintainability
- Occurrences
- 32
- Severity
- warning
Sample message
Use of a direct database call is discouraged.
WARNINGSecurityMissing nonce verificationProcessing form data without nonce verification.32
- Category
- Security
- Occurrences
- 32
- Severity
- warning
Sample message
Processing form data without nonce verification.
ERRORI18nMissing Translators CommentA function call to __() with texts containing placeholders was found, but was not accompanied by a "translators:" comment on the line above to clarify the meaning of the placeholders.28
- Category
- I18n
- Occurrences
- 28
- Severity
- error
Sample message
A function call to __() with texts containing placeholders was found, but was not accompanied by a "translators:" comment on the line above to clarify the meaning of the placeholders.
WARNINGMaintainabilityNon-prefixed functionFunctions declared in the global namespace by a theme/plugin should start with the theme/plugin prefix. Found: "apply_custom_field_order".19
- Category
- Maintainability
- Occurrences
- 19
- Severity
- warning
Sample message
Functions declared in the global namespace by a theme/plugin should start with the theme/plugin prefix. Found: "apply_custom_field_order".
Show 15 moreShow less
WARNINGMaintainabilityNo Caching18
- Category
- Maintainability
- Occurrences
- 18
- Severity
- warning
Sample message
Direct database call without caching detected. Consider using wp_cache_get() / wp_cache_set() or wp_cache_delete().
WARNINGSecurityDatabase parameter is not escaped16
- Category
- Security
- Occurrences
- 16
- Severity
- warning
Sample message
Unescaped parameter $column used in $wpdb->get_col()\n$column used without escaping.
WARNINGMaintainabilityNon-prefixed class11
- Category
- Maintainability
- Occurrences
- 11
- Severity
- warning
Sample message
Classes declared by a theme/plugin should start with the theme/plugin prefix. Found: "BridgeResoClass".
WARNINGSecurityInterpolated SQL is not prepared8
- Category
- Security
- Occurrences
- 8
- Severity
- warning
Sample message
Use placeholders and $wpdb->prepare(); found interpolated variable {$orderby} at "SELECT * FROM {$table} {$where} ORDER BY {$orderby} {$order} LIMIT %d OFFSET %d"
ERRORSecuritySQL query is not prepared6
- Category
- Security
- Occurrences
- 6
- Severity
- error
Sample message
Use placeholders and $wpdb->prepare(); found $meta_values
ERRORMaintainabilityPlugin Directory Write5
- Category
- Maintainability
- Occurrences
- 5
- Severity
- error
Sample message
Plugin folders are deleted when upgraded. Do not save data to the plugin folder using file_put_contents(). Detected usage of constant WP_PLUGIN_DIR. Use wp_upload_dir() to get the uploads directory path or save to the database instead.
WARNINGMaintainabilityslow db query meta query5
- Category
- Maintainability
- Occurrences
- 5
- Severity
- warning
Sample message
Detected usage of meta_query, possible slow query.
WARNINGMaintainabilityslow db query meta value5
- Category
- Maintainability
- Occurrences
- 5
- Severity
- warning
Sample message
Detected usage of meta_value, possible slow query.
ERRORMaintainabilitydate date5
- Category
- Maintainability
- Occurrences
- 5
- Severity
- error
Sample message
date() is affected by runtime timezone changes which can cause date/time to be incorrectly displayed. Use gmdate() instead.
WARNINGSecurityUnfinished Prepare4
- Category
- Security
- Occurrences
- 4
- Severity
- warning
Sample message
Replacement variables found, but no valid placeholders found in the query.
WARNINGMaintainabilityslow db query meta key4
- Category
- Maintainability
- Occurrences
- 4
- Severity
- warning
Sample message
Detected usage of meta_key, possible slow query.
WARNINGSecuritywp redirect wp redirect4
- Category
- Security
- Occurrences
- 4
- Severity
- warning
Sample message
wp_redirect() found. Using wp_safe_redirect(), along with the "allowed_redirect_hosts" filter if needed, can help avoid any chances of malicious redirects within code. It is also important to remember to call exit() after a redirect so that no other unwanted code is executed.
WARNINGSecurityInput is not validated4
- Category
- Security
- Occurrences
- 4
- Severity
- warning
Sample message
Detected usage of a possibly undefined superglobal array index: $_POST['is_onboard']. Check that the array index exists before using it.
ERRORMaintainabilityfile system operations mkdir3
- Category
- Maintainability
- Occurrences
- 3
- Severity
- error
Sample message
File operations should use WP_Filesystem methods instead of direct PHP filesystem calls. Found: mkdir().
ERRORSecurityDatabase parameter is not escaped2
- Category
- Security
- Occurrences
- 2
- Severity
- error
Sample message
Unescaped parameter $sql used in $wpdb->get_results()\n$sql assigned unsafely at line 234.
External Connections
Potential connections found in static code analysis.
Outbound calls
202
External assets
3
Incoming endpoints
40
Notable Domains
mlsimport.com30 · outbound
php.net20 · outbound
en.wikipedia.org16 · outbound
secure.php.net12 · outbound
actionscheduler.org9 · outbound
automattic.com7 · outbound
Platform / Reference Domains
github.com30 · platform/reference
w3.org10 · platform/reference
wordpress.org9 · platform/reference
core.trac.wordpress.org8 · platform/reference
gnu.org5 · platform/reference
codex.wordpress.org3 · platform/reference
schema.org1 · platform/reference
External Asset Domains
fonts.googleapis.com3 · asset
Incoming Endpoints
wp_ajax_nopriv_public
wp_ajax
wp_ajax_nopriv_mlsimport_fav_noncepublic
wp_ajax
wp_ajax_nopriv_mlsimport_saved_cardspublic
wp_ajax
Admin AJAX endpoints30
wp_ajax_mlsimport_check_initial_save_neededauthenticated
wp_ajax
wp_ajax_mlsimport_clear_fields_dataauthenticated
wp_ajax
wp_ajax_mlsimport_delete_cacheauthenticated
wp_ajax
wp_ajax_mlsimport_delete_propertiesauthenticated
wp_ajax
wp_ajax_mlsimport_dismiss_activity_bannerauthenticated
wp_ajax
wp_ajax_mlsimport_dismiss_protected_noticeauthenticated
wp_ajax
wp_ajax_mlsimport_exit_survey_submitauthenticated
wp_ajax
wp_ajax_mlsimport_fav_mergeauthenticated
wp_ajax
wp_ajax_mlsimport_fav_nonceauthenticated
wp_ajax
wp_ajax_mlsimport_fav_toggleauthenticated
wp_ajax
wp_ajax_mlsimport_get_taxonomy_termsauthenticated
wp_ajax
wp_ajax_mlsimport_logger_per_itemauthenticated
wp_ajax
18 more hidden
Score History
5 score snapshots
v7.0.7
24
Latest
- Findings
- 795
- Errors
- 167
- Warnings
- 628
- Check
- 2.0.0
v6.3.8
27
Score
- Findings
- 705
- Errors
- 154
- Warnings
- 551
- Check
- 2.0.0
| Scan | Score | Findings | Errors | Warnings | Plugin | Check |
|---|---|---|---|---|---|---|
| Latest | 24 | 795 | 167 | 628 | v7.0.7 | 2.0.0 |
| 27 | 705 | 154 | 551 | v6.3.8 | 2.0.0 |
Relationship Map
Author, categories, issues, domains, and nearby plugins.
Loading map
PluginAuthorCategoryIssueDomainRelated
Relationship links
Author
Issue
Domain
Related
WooCommerce21 scoreContact Form 769 scoreElementor Website Builder – more than just a page builder39 scoreYoast SEO – Advanced SEO with real-time guidance and built-in AI24 scoreClassic Editor63 scoreLiteSpeed Cache35 scoreAkismet Anti-spam: Spam Protection35 scoreWordfence Security – Firewall, Malware Scan, and Login Security21 scoreDuplicate Page40 scoreReally Simple Security – Simple and Performant Security (formerly Really Simple SSL)19 scoreWordPress Importer25 scoreEstatik Real Estate Plugin22 scoreOptima Express IDX34 scoreWP VR – 360 Panorama and Virtual Tour Builder37 score
Author
Issue
Domain
Related
WooCommerce21 scoreContact Form 769 scoreElementor Website Builder – more than just a page builder39 scoreYoast SEO – Advanced SEO with real-time guidance and built-in AI24 scoreClassic Editor63 scoreLiteSpeed Cache35 scoreAkismet Anti-spam: Spam Protection35 scoreWordfence Security – Firewall, Malware Scan, and Login Security21 scoreDuplicate Page40 scoreReally Simple Security – Simple and Performant Security (formerly Really Simple SSL)19 scoreWordPress Importer25 scoreEstatik Real Estate Plugin22 scoreOptima Express IDX34 scoreWP VR – 360 Panorama and Virtual Tour Builder37 score
Related Plugins
WPCasa Advanced Search
600 active installs
99
ERE Colors – Essential Real Estate Add-On
1k+ active installs
92
ERE Similar Properties – Essential Real Estate Add-On
1k+ active installs
91
RateMyAgent Official
400 active installs
89
83
Agent Image News
2k+ active installs
82