myCred Toolkit with AI Assistant – Scale Your Loyalty & Gamification Rewards With Integrations

Scale loyalty and gamification with 49 free add-ons plus the AI Assistant (Experiment) for conversational myCred management in WordPress and WooCommer …

v1.4.5Saad IqbalUpdated 1 month agoAdded 2 years ago400 installs100% rating

Points and Rewards Points system WooCommerce gamification WordPress Gamification toolkit

Score

1,588

Errors

1,172

Warnings

Change

Category Scores

Security0

Repo80

Performance98

Maintainability0

Issues to Review

Prioritized issue groups from the latest Plugin Check scan

2,760 findings

Security

1,240

10 issue groups

Maintainability

944

13 issue groups

I18n

428

2 issue groups

ERRORSecurityOutput is not escapedAll output should be run through an escaping function (see the Security sections in the WordPress Developer Handbooks), found '$_SESSION['mycred_message']'.735

Category: Security
Occurrences: 735
Severity: error

Sample message

All output should be run through an escaping function (see the Security sections in the WordPress Developer Handbooks), found '$_SESSION['mycred_message']'.

WordPress.Security.EscapeOutput.OutputNotEscaped Reference

ERRORI18nText Domain MismatchMismatched text domain. Expected 'mycred-toolkit' but got "myCred_pmp".410

Category: I18n
Occurrences: 410
Severity: error

Sample message

Mismatched text domain. Expected 'mycred-toolkit' but got "myCred_pmp".

WordPress.WP.I18n.TextDomainMismatch Reference

ERRORMaintainabilityMissing direct file access protectionPHP file should prevent direct access. Add a check like: if ( ! defined( 'ABSPATH' ) ) exit;173

Category: Maintainability
Occurrences: 173
Severity: error

Sample message

PHP file should prevent direct access. Add a check like: if ( ! defined( 'ABSPATH' ) ) exit;

missing_direct_file_access_protection Reference

WARNINGMaintainabilityNon-prefixed classClasses declared by a theme/plugin should start with the theme/plugin prefix. Found: "EEG_myCRED_Onsite".169

Category: Maintainability
Occurrences: 169
Severity: warning

Sample message

Classes declared by a theme/plugin should start with the theme/plugin prefix. Found: "EEG_myCRED_Onsite".

WordPress.NamingConventions.PrefixAllGlobals.NonPrefixedClassFound

WARNINGSecurityMissing nonce verificationProcessing form data without nonce verification.152

Category: Security
Occurrences: 152
Severity: warning

Sample message

Processing form data without nonce verification.

WordPress.Security.NonceVerification.Missing

WARNINGMaintainabilityDirect QueryUse of a direct database call is discouraged.93

Category: Maintainability
Occurrences: 93
Severity: warning

Sample message

Use of a direct database call is discouraged.

WordPress.DB.DirectDatabaseQuery.DirectQuery

WARNINGMaintainabilityNon-prefixed functionFunctions declared in the global namespace by a theme/plugin should start with the theme/plugin prefix. Found: "add_badge_support".92

Category: Maintainability
Occurrences: 92
Severity: warning

Sample message

Functions declared in the global namespace by a theme/plugin should start with the theme/plugin prefix. Found: "add_badge_support".

WordPress.NamingConventions.PrefixAllGlobals.NonPrefixedFunctionFound

WARNINGMaintainabilityNo CachingDirect database call without caching detected. Consider using wp_cache_get() / wp_cache_set() or wp_cache_delete().87

Category: Maintainability
Occurrences: 87
Severity: warning

Sample message

Direct database call without caching detected. Consider using wp_cache_get() / wp_cache_set() or wp_cache_delete().

WordPress.DB.DirectDatabaseQuery.NoCaching

WARNINGSecurityRequest data is not unslashed$_GET['code'] not unslashed before sanitization. Use wp_unslash() or similar67

Category: Security
Occurrences: 67
Severity: warning

Sample message

$_GET['code'] not unslashed before sanitization. Use wp_unslash() or similar

WordPress.Security.ValidatedSanitizedInput.MissingUnslash

WARNINGSecurityInterpolated SQL is not preparedUse placeholders and $wpdb->prepare(); found interpolated variable $gp_logs at SELECT l.log_id, l.title, l.user_id, l.trigger_type,l.date FROM $gp_logs as l\n66

Category: Security
Occurrences: 66
Severity: warning

Sample message

Use placeholders and $wpdb->prepare(); found interpolated variable $gp_logs at SELECT l.log_id, l.title, l.user_id, l.trigger_type,l.date FROM $gp_logs as l\n

WordPress.DB.PreparedSQL.InterpolatedNotPrepared

Show 15 more

WARNINGSecurityNonce verification recommended57

Category: Security
Occurrences: 57
Severity: warning

Sample message

Processing form data without nonce verification.

WordPress.Security.NonceVerification.Recommended

ERRORMaintainabilitydate date56

Category: Maintainability
Occurrences: 56
Severity: error

Sample message

date() is affected by runtime timezone changes which can cause date/time to be incorrectly displayed. Use gmdate() instead.

WordPress.DateTime.RestrictedFunctions.date_date

WARNINGMaintainabilityNon-prefixed global variable54

Category: Maintainability
Occurrences: 54
Severity: warning

Sample message

Global constants defined by a theme/plugin should start with the theme/plugin prefix. Found: "$name".

WordPress.NamingConventions.PrefixAllGlobals.VariableConstantNameFound

ERRORMaintainabilitycurl curl setopt52

Category: Maintainability
Occurrences: 52
Severity: error

Sample message

Using cURL functions is highly discouraged. Use wp_remote_get() instead.

WordPress.WP.AlternativeFunctions.curl_curl_setopt

WARNINGSecurityInput is not validated50

Category: Security
Occurrences: 50
Severity: warning

Sample message

Detected usage of a possibly undefined superglobal array index: $_GET['code']. Check that the array index exists before using it.

WordPress.Security.ValidatedSanitizedInput.InputNotValidated

WARNINGMaintainabilityNon-prefixed constant44

Category: Maintainability
Occurrences: 44
Severity: warning

Sample message

Global constants defined by a theme/plugin should start with the theme/plugin prefix. Found: "EE_MYCRED_PAYMENT_METHOD_BASENAME".

WordPress.NamingConventions.PrefixAllGlobals.NonPrefixedConstantFound

ERRORSecurityUnsafe printing function44

Category: Security
Occurrences: 44
Severity: error

Sample message

All output should be run through an escaping function (like esc_html_e() or esc_attr_e()), found '_e'.

WordPress.Security.EscapeOutput.UnsafePrintingFunction Reference

WARNINGMaintainabilityNon-prefixed global variable40

Category: Maintainability
Occurrences: 40
Severity: warning

Sample message

Global variables defined by a theme/plugin should start with the theme/plugin prefix. Found: "$abc".

WordPress.NamingConventions.PrefixAllGlobals.NonPrefixedVariableFound

WARNINGMaintainabilityNon-prefixed hook name39

Category: Maintainability
Occurrences: 39
Severity: warning

Sample message

Hook names invoked by a theme/plugin should start with the theme/plugin prefix. Found: "active_plugins".

WordPress.NamingConventions.PrefixAllGlobals.NonPrefixedHooknameFound

WARNINGMaintainabilityNot In Footer28

Category: Maintainability
Occurrences: 28
Severity: warning

Sample message

In footer ($in_footer) is not set explicitly wp_enqueue_script; It is recommended to load scripts in the footer. Please set this value to `true` to load it in the footer, or explicitly `false` if it should be loaded in the header.

WordPress.WP.EnqueuedResourceParameters.NotInFooter

WARNINGSecurityInput is not sanitized25

Category: Security
Occurrences: 25
Severity: warning

Sample message

Detected usage of a non-sanitized input variable: $_GET['wc_woosquare_token_nonce']

WordPress.Security.ValidatedSanitizedInput.InputNotSanitized

ERRORSecurityDatabase parameter is not escaped24

Category: Security
Occurrences: 24
Severity: error

Sample message

Unescaped parameter $group_table used in $wpdb->get_results()

PluginCheck.Security.DirectDB.UnescapedDBParameter

WARNINGSecurityDatabase parameter is not escaped20

Category: Security
Occurrences: 20
Severity: warning

Sample message

Unescaped parameter $gp_logs used in $wpdb->get_results()\n$gp_logs assigned unsafely at line 310.

PluginCheck.Security.DirectDB.UnescapedDBParameter

WARNINGI18nDiscouraged text-domain loading18

Category: I18n
Occurrences: 18
Severity: warning

Sample message

load_plugin_textdomain() has been discouraged since WordPress version 4.6. When your plugin is hosted on WordPress.org, you no longer need to manually include this function call for translations under your plugin slug. WordPress will automatically load the translations for you as needed.

PluginCheck.CodeAnalysis.DiscouragedFunctions.load_plugin_textdomainFound Reference

WARNINGMaintainabilityMissing Version17

Category: Maintainability
Occurrences: 17
Severity: warning

Sample message

Resource version not set in call to wp_enqueue_script(). This means new versions of the script may not always be loaded due to browser caching.

WordPress.WP.EnqueuedResourceParameters.MissingVersion

External Connections

Potential connections found in static code analysis.

25 domains

Outbound calls

113

External assets

Incoming endpoints

Notable Domains

jqueryui.com14 · outbound

docs.jquery.com13 · outbound

jquery.org13 · outbound

api.badgr.io7 · outbound

mycred.me7 · outbound

api.github.com3 · outbound

Platform / Reference Domains

wordpress.org15 · platform/reference

github.com4 · platform/reference

gnu.org1 · platform/reference

External Asset Domains

codex.mycred.me21 · asset + outbound

fonts.googleapis.com1 · asset

Incoming Endpoints

wp_ajax_nopriv_mycred_specific_course_for_userspublic

wp_ajax

/wp-json/mycred-toolkit/v1/check-addons-filesREST

register_rest_route

/wp-json/mycred-toolkit/v1/enable-addonREST

register_rest_route

/wp-json/mycred-toolkit/v1/get-addonsREST

register_rest_route

/wp-json/zapier/v1/authREST

register_rest_route

/wp-json/zapier/v1/deducted-logsREST

register_rest_route

Admin AJAX endpoints37

wp_ajax_mycred_specific_course_for_usersauthenticated

wp_ajax

wp_ajax_addremove_friendauthenticated

wp_ajax

wp_ajax_award_booking_pointsauthenticated

wp_ajax

wp_ajax_badgr-login-disconnectauthenticated

wp_ajax

wp_ajax_get-mycred-credly-badges-listauthenticated

wp_ajax

wp_ajax_mcs_payment_processauthenticated

wp_ajax

wp_ajax_mg_disconnect_actionauthenticated

wp_ajax

wp_ajax_mg_github_callbackauthenticated

wp_ajax

wp_ajax_mg_refresh_repositories_actionauthenticated

wp_ajax

wp_ajax_mycred_ai_chatauthenticated

wp_ajax

wp_ajax_mycred_badgr_adminauthenticated

wp_ajax

wp_ajax_mycred_course_based_optionsauthenticated

wp_ajax

25 more hidden

Score History

First score snapshot

2 days ago

v1.4.5

Latest

Findings: 2,760
Errors: 1,588
Warnings: 1,172
Check: 2.0.0

Scan	Score	Findings	Errors	Warnings	Plugin	Check
2 days agoLatest	22	2,760	1,588	1,172	v1.4.5	2.0.0

Relationship Map

Author, categories, issues, domains, and nearby plugins.

37 nodes

Loading map

PluginAuthorCategoryIssueDomainRelated

Relationship links

Issue

Domain

jqueryui.com14 signals docs.jquery.com13 signals jquery.org13 signals api.badgr.io7 signals mycred.me7 signals api.github.com3 signals raw.github.com2 signals sandbox-api.credly.com2 signals

Related Plugins

Points and Rewards for WooCommerce

7k+ active installs

WPLMS MyCred AddOn

800 active installs