IDX and MLS plugin for WordPress. Import and sync real estate listings from 800+ MLS via the RESO Web API, on any theme.
28
Score
152
Errors
467
Warnings
+0
Change
Category Scores
Security0
Repo94
Performance98
Maintainability19
Issues to Review
Prioritized issue groups from the latest Plugin Check scan
Maintainability
314
12 issue groups
Security
252
12 issue groups
I18n
28
1 issue group
WARNINGMaintainabilityNon-prefixed global variableGlobal variables defined by a theme/plugin should start with the theme/plugin prefix. Found: "$active_credential_fields".219
- Category
- Maintainability
- Occurrences
- 219
- Severity
- warning
Sample message
Global variables defined by a theme/plugin should start with the theme/plugin prefix. Found: "$active_credential_fields".
ERRORSecurityUnsafe printing functionAll output should be run through an escaping function (like esc_html_e() or esc_attr_e()), found '_e'.61
- Category
- Security
- Occurrences
- 61
- Severity
- error
Sample message
All output should be run through an escaping function (like esc_html_e() or esc_attr_e()), found '_e'.
WARNINGSecurityNonce verification recommendedProcessing form data without nonce verification.37
- Category
- Security
- Occurrences
- 37
- Severity
- warning
Sample message
Processing form data without nonce verification.
WARNINGSecurityInput is not sanitizedDetected usage of a non-sanitized input variable: $_GET['mls']32
- Category
- Security
- Occurrences
- 32
- Severity
- warning
Sample message
Detected usage of a non-sanitized input variable: $_GET['mls']
ERRORSecurityOutput is not escapedAll output should be run through an escaping function (see the Security sections in the WordPress Developer Handbooks), found '$current_step'.31
- Category
- Security
- Occurrences
- 31
- Severity
- error
Sample message
All output should be run through an escaping function (see the Security sections in the WordPress Developer Handbooks), found '$current_step'.
ERRORI18nMissing Translators CommentA function call to __() with texts containing placeholders was found, but was not accompanied by a "translators:" comment on the line above to clarify the meaning of the placeholders.28
- Category
- I18n
- Occurrences
- 28
- Severity
- error
Sample message
A function call to __() with texts containing placeholders was found, but was not accompanied by a "translators:" comment on the line above to clarify the meaning of the placeholders.
WARNINGSecurityMissing nonce verificationProcessing form data without nonce verification.27
- Category
- Security
- Occurrences
- 27
- Severity
- warning
Sample message
Processing form data without nonce verification.
WARNINGMaintainabilityNon-prefixed classClasses declared by a theme/plugin should start with the theme/plugin prefix. Found: "BridgeResoClass".22
- Category
- Maintainability
- Occurrences
- 22
- Severity
- warning
Sample message
Classes declared by a theme/plugin should start with the theme/plugin prefix. Found: "BridgeResoClass".
WARNINGMaintainabilityDirect QueryUse of a direct database call is discouraged.20
- Category
- Maintainability
- Occurrences
- 20
- Severity
- warning
Sample message
Use of a direct database call is discouraged.
WARNINGSecurityRequest data is not unslashed$_GET['plugin'] not unslashed before sanitization. Use wp_unslash() or similar20
- Category
- Security
- Occurrences
- 20
- Severity
- warning
Sample message
$_GET['plugin'] not unslashed before sanitization. Use wp_unslash() or similar
Show 15 moreShow less
WARNINGSecurityDatabase parameter is not escaped18
- Category
- Security
- Occurrences
- 18
- Severity
- warning
Sample message
Unescaped parameter $column used in $wpdb->get_col()\n$column used without escaping.
WARNINGMaintainabilityNo Caching17
- Category
- Maintainability
- Occurrences
- 17
- Severity
- warning
Sample message
Direct database call without caching detected. Consider using wp_cache_get() / wp_cache_set() or wp_cache_delete().
WARNINGSecurityInterpolated SQL is not prepared10
- Category
- Security
- Occurrences
- 10
- Severity
- warning
Sample message
Use placeholders and $wpdb->prepare(); found interpolated variable {$orderby} at "SELECT * FROM {$table} {$where} ORDER BY {$orderby} {$order} LIMIT %d OFFSET %d"
WARNINGMaintainabilityslow db query meta query6
- Category
- Maintainability
- Occurrences
- 6
- Severity
- warning
Sample message
Detected usage of meta_query, possible slow query.
WARNINGMaintainabilityerror log error log6
- Category
- Maintainability
- Occurrences
- 6
- Severity
- warning
Sample message
error_log() found. Debug code should not normally be used in production.
ERRORSecuritySQL query is not prepared5
- Category
- Security
- Occurrences
- 5
- Severity
- error
Sample message
Use placeholders and $wpdb->prepare(); found $exclusion
ERRORMaintainabilitywp function not compatible with requires wp5
- Category
- Maintainability
- Occurrences
- 5
- Severity
- error
Sample message
Function "wp_cache_flush_runtime()" requires WordPress 6.0.0, but your plugin minimum supported version is WordPress 5.2.0.
ERRORMaintainabilityPlugin Directory Write4
- Category
- Maintainability
- Occurrences
- 4
- Severity
- error
Sample message
Plugin folders are deleted when upgraded. Do not save data to the plugin folder using file_put_contents(). Detected usage of constant WP_PLUGIN_DIR. Use wp_upload_dir() to get the uploads directory path or save to the database instead.
WARNINGSecurityUnfinished Prepare4
- Category
- Security
- Occurrences
- 4
- Severity
- warning
Sample message
Replacement variables found, but no valid placeholders found in the query.
ERRORMaintainabilitydate date4
- Category
- Maintainability
- Occurrences
- 4
- Severity
- error
Sample message
date() is affected by runtime timezone changes which can cause date/time to be incorrectly displayed. Use gmdate() instead.
WARNINGMaintainabilityNon-prefixed function4
- Category
- Maintainability
- Occurrences
- 4
- Severity
- warning
Sample message
Functions declared in the global namespace by a theme/plugin should start with the theme/plugin prefix. Found: "force_recount_all_terms".
WARNINGMaintainabilityNon-prefixed hook name4
- Category
- Maintainability
- Occurrences
- 4
- Severity
- warning
Sample message
Hook names invoked by a theme/plugin should start with the theme/plugin prefix. Found: "the_content".
WARNINGSecuritywp redirect wp redirect4
- Category
- Security
- Occurrences
- 4
- Severity
- warning
Sample message
wp_redirect() found. Using wp_safe_redirect(), along with the "allowed_redirect_hosts" filter if needed, can help avoid any chances of malicious redirects within code. It is also important to remember to call exit() after a redirect so that no other unwanted code is executed.
WARNINGMaintainabilityslow db query meta value3
- Category
- Maintainability
- Occurrences
- 3
- Severity
- warning
Sample message
Detected usage of meta_value, possible slow query.
WARNINGSecurityInput is not validated3
- Category
- Security
- Occurrences
- 3
- Severity
- warning
Sample message
Detected usage of a possibly undefined superglobal array index: $_POST['mlsimport_delete_category']. Check that the array index exists before using it.
External Connections
Potential connections found in static code analysis.
Outbound calls
206
External assets
3
Incoming endpoints
41
Notable Domains
mlsimport.com35 · outbound
php.net20 · outbound
en.wikipedia.org16 · outbound
secure.php.net12 · outbound
actionscheduler.org10 · outbound
automattic.com7 · outbound
Platform / Reference Domains
github.com27 · platform/reference
w3.org10 · platform/reference
wordpress.org9 · platform/reference
core.trac.wordpress.org8 · platform/reference
gnu.org5 · platform/reference
codex.wordpress.org3 · platform/reference
schema.org1 · platform/reference
External Asset Domains
fonts.googleapis.com3 · asset
Incoming Endpoints
wp_ajax_nopriv_public
wp_ajax
wp_ajax_nopriv_mlsimport_fav_noncepublic
wp_ajax
wp_ajax_nopriv_mlsimport_saved_cardspublic
wp_ajax
Admin AJAX endpoints30
wp_ajax_mlsimport_change_field_configurationauthenticated
wp_ajax
wp_ajax_mlsimport_clear_fields_dataauthenticated
wp_ajax
wp_ajax_mlsimport_connections_addauthenticated
wp_ajax
wp_ajax_mlsimport_connections_disconnectauthenticated
wp_ajax
wp_ajax_mlsimport_connections_editauthenticated
wp_ajax
wp_ajax_mlsimport_connections_removeauthenticated
wp_ajax
wp_ajax_mlsimport_connections_reorderauthenticated
wp_ajax
wp_ajax_mlsimport_connections_seedauthenticated
wp_ajax
wp_ajax_mlsimport_connections_testauthenticated
wp_ajax
wp_ajax_mlsimport_delete_cacheauthenticated
wp_ajax
wp_ajax_mlsimport_delete_propertiesauthenticated
wp_ajax
wp_ajax_mlsimport_dismiss_activity_bannerauthenticated
wp_ajax
18 more hidden
Score History
10 score snapshots
v7.2.1
28
Latest
- Findings
- 619
- Errors
- 152
- Warnings
- 467
- Check
- 2.1.0
v7.2
28
Score
- Findings
- 619
- Errors
- 152
- Warnings
- 467
- Check
- 2.1.0
| Scan | Score | Findings | Errors | Warnings | Plugin | Check |
|---|---|---|---|---|---|---|
| Latest | 28 | 619 | 152 | 467 | v7.2.1 | 2.1.0 |
| 28 | 619 | 152 | 467 | v7.2 | 2.1.0 |
Relationship Map
Author, categories, issues, domains, and nearby plugins.
Loading map
PluginAuthorCategoryIssueDomainRelated
Relationship links
Author
Issue
Domain
Related
WooCommerce22 scoreContact Form 769 scoreElementor Website Builder – more than just a page builder39 scoreYoast SEO – Advanced SEO with real-time guidance and built-in AI24 scoreClassic Editor63 scoreLiteSpeed Cache35 scoreAkismet Anti-spam: Spam Protection35 scoreWordfence Security – Firewall, Malware Scan, and Login Security21 scoreDuplicate Page40 scoreReally Simple Security – Simple and Performant Security (formerly Really Simple SSL)19 scoreWordPress Importer25 scoreEstatik Real Estate Plugin22 scoreOptima Express IDX33 scoreWPVR – 360 Panorama viewer and Virtual Tour Builder for WordPress35 score
Author
Issue
Domain
Related
WooCommerce22 scoreContact Form 769 scoreElementor Website Builder – more than just a page builder39 scoreYoast SEO – Advanced SEO with real-time guidance and built-in AI24 scoreClassic Editor63 scoreLiteSpeed Cache35 scoreAkismet Anti-spam: Spam Protection35 scoreWordfence Security – Firewall, Malware Scan, and Login Security21 scoreDuplicate Page40 scoreReally Simple Security – Simple and Performant Security (formerly Really Simple SSL)19 scoreWordPress Importer25 scoreEstatik Real Estate Plugin22 scoreOptima Express IDX33 scoreWPVR – 360 Panorama viewer and Virtual Tour Builder for WordPress35 score
Related Plugins
WPCasa Advanced Search
600 active installs
99
Roomvu Marketing
400 active installs
95
ERE Colors – Essential Real Estate Add-On
1k+ active installs
92
ERE Similar Properties – Essential Real Estate Add-On
1k+ active installs
91
RateMyAgent Official
400 active installs
89
Agent Image News
2k+ active installs
82