PDF Builder for WPForms

The first and only PDF drag and drop builder for WPForms.

v1.2.148EDGARROJASUpdated Added 900 installs80% rating
22
Score
321
Errors
266
Warnings
+0
Change

Category Scores

Security0
Repo83
Performance100
Maintainability0

Issues to Review

Prioritized issue groups from the latest Plugin Check scan

587 findings

Security

342

10 issue groups

Maintainability

210

15 issue groups

ERRORSecuritySQL query is not preparedUse placeholders and $wpdb->prepare(); found $loader125
Category
Security
Occurrences
125
Severity
error

Sample message

Use placeholders and $wpdb->prepare(); found $loader

ERRORSecurityException output is not escapedAll output should be run through an escaping function (see the Security sections in the WordPress Developer Handbooks), found '$Lookup[$i]['Type']'.80
Category
Security
Occurrences
80
Severity
error

Sample message

All output should be run through an escaping function (see the Security sections in the WordPress Developer Handbooks), found '$Lookup[$i]['Type']'.

WARNINGMaintainabilityDirect QueryUse of a direct database call is discouraged.49
Category
Maintainability
Occurrences
49
Severity
warning

Sample message

Use of a direct database call is discouraged.

WARNINGMaintainabilityNo CachingDirect database call without caching detected. Consider using wp_cache_get() / wp_cache_set() or wp_cache_delete().43
Category
Maintainability
Occurrences
43
Severity
warning

Sample message

Direct database call without caching detected. Consider using wp_cache_get() / wp_cache_set() or wp_cache_delete().

ERRORSecurityOutput is not escapedAll output should be run through an escaping function (see the Security sections in the WordPress Developer Handbooks), found '"@font-face{font-family:\"$font\";\r\n'.40
Category
Security
Occurrences
40
Severity
error

Sample message

All output should be run through an escaping function (see the Security sections in the WordPress Developer Handbooks), found '"@font-face{font-family:\"$font\";\r\n'.

WARNINGMaintainabilityNon-prefixed global variableGlobal variables defined by a theme/plugin should start with the theme/plugin prefix. Found: "$HTML".35
Category
Maintainability
Occurrences
35
Severity
warning

Sample message

Global variables defined by a theme/plugin should start with the theme/plugin prefix. Found: "$HTML".

WARNINGSecurityDatabase parameter is not escapedUnescaped parameter $this->Loader->FormConfigTable used in $wpdb->get_results()32
Category
Security
Occurrences
32
Severity
warning

Sample message

Unescaped parameter $this->Loader->FormConfigTable used in $wpdb->get_results()

WARNINGSecurityNonce verification recommendedProcessing form data without nonce verification.21
Category
Security
Occurrences
21
Severity
warning

Sample message

Processing form data without nonce verification.

WARNINGMaintainabilityerror log var exportvar_export() found. Debug code should not normally be used in production.18
Category
Maintainability
Occurrences
18
Severity
warning

Sample message

var_export() found. Debug code should not normally be used in production.

ERRORMaintainabilityfile system operations freadFile operations should use WP_Filesystem methods instead of direct PHP filesystem calls. Found: fread().14
Category
Maintainability
Occurrences
14
Severity
error

Sample message

File operations should use WP_Filesystem methods instead of direct PHP filesystem calls. Found: fread().

Show 15 more
WARNINGSecurityInput is not sanitized13
Category
Security
Occurrences
13
Severity
warning

Sample message

Detected usage of a non-sanitized input variable: $_FILES['ImportFile']['tmp_name']

ERRORMaintainabilitydate date10
Category
Maintainability
Occurrences
10
Severity
error

Sample message

date() is affected by runtime timezone changes which can cause date/time to be incorrectly displayed. Use gmdate() instead.

WARNINGSecurityRequest data is not unslashed10
Category
Security
Occurrences
10
Severity
warning

Sample message

$_GET['_nonce'] not unslashed before sanitization. Use wp_unslash() or similar

WARNINGSecurityMissing nonce verification9
Category
Security
Occurrences
9
Severity
warning

Sample message

Processing form data without nonce verification.

WARNINGSecurityInput is not validated8
Category
Security
Occurrences
8
Severity
warning

Sample message

Detected usage of a possibly undefined superglobal array index: $_FILES['ImportFile']['tmp_name']. Check that the array index exists before using it.

ERRORMaintainabilityfile system operations fopen7
Category
Maintainability
Occurrences
7
Severity
error

Sample message

File operations should use WP_Filesystem methods instead of direct PHP filesystem calls. Found: fopen().

ERRORMaintainabilityMissing direct file access protection7
Category
Maintainability
Occurrences
7
Severity
error

Sample message

PHP file should prevent direct access. Add a check like: if ( ! defined( 'ABSPATH' ) ) exit;

ERRORMaintainabilityfile system operations fclose6
Category
Maintainability
Occurrences
6
Severity
error

Sample message

File operations should use WP_Filesystem methods instead of direct PHP filesystem calls. Found: fclose().

ERRORSecurityDatabase parameter is not escaped4
Category
Security
Occurrences
4
Severity
error

Sample message

Unescaped parameter $loader->CUSTOM_FIELD used in $wpdb->get_results()\n$loader->CUSTOM_FIELD used without escaping.

WARNINGMaintainabilityNon-prefixed hook name4
Category
Maintainability
Occurrences
4
Severity
warning

Sample message

Hook names invoked by a theme/plugin should start with the theme/plugin prefix. Found: "pdfbuilder_get_loader".

ERRORMaintainabilityfile system operations mkdir4
Category
Maintainability
Occurrences
4
Severity
error

Sample message

File operations should use WP_Filesystem methods instead of direct PHP filesystem calls. Found: mkdir().

WARNINGMaintainabilityNot In Footer4
Category
Maintainability
Occurrences
4
Severity
warning

Sample message

In footer ($in_footer) is not set explicitly wp_enqueue_script; It is recommended to load scripts in the footer. Please set this value to `true` to load it in the footer, or explicitly `false` if it should be loaded in the header.

WARNINGMaintainabilityNon-prefixed constant3
Category
Maintainability
Occurrences
3
Severity
warning

Sample message

Global constants defined by a theme/plugin should start with the theme/plugin prefix. Found: "_OTL_OLD_SPEC_COMPAT_2".

ERRORMaintainabilityfile system operations rmdir3
Category
Maintainability
Occurrences
3
Severity
error

Sample message

File operations should use WP_Filesystem methods instead of direct PHP filesystem calls. Found: rmdir().

WARNINGMaintainabilityMissing Version3
Category
Maintainability
Occurrences
3
Severity
warning

Sample message

Resource version not set in call to wp_enqueue_script(). This means new versions of the script may not always be loaded due to browser caching.

External Connections

Potential connections found in static code analysis.

60 domains

Outbound calls

296

External assets

0

Incoming endpoints

4

Notable Domains

dompdf.github.com43 · outbound
formwiz.rednao.com13 · outbound
hakim.se5 · outbound
lab.hakim.se5 · outbound
microsoft.com5 · outbound

Platform / Reference Domains

w3.org78 · platform/reference
gnu.org44 · platform/reference
github.com23 · platform/reference
wordpress.org1 · platform/reference

External Asset Domains

No external asset domains detected.

Incoming Endpoints

No public endpoints detected.

Admin AJAX endpoints4
wp_ajax_pdf_builder_dont_show_again_noticeauthenticated

wp_ajax

wp_ajax_rednao_validate_google_auth_token1authenticated

wp_ajax

wp_ajax_rednao_validate_google_auth_token2authenticated

wp_ajax

wp_ajax_rednao_validate_google_auth_token3authenticated

wp_ajax

Score History

First score snapshot

v1.2.148

22

Latest

Findings
587
Errors
321
Warnings
266
Check
2.0.0

Relationship Map

Author, categories, issues, domains, and nearby plugins.

37 nodes

Related

Related Plugins