PeachPay — Payments & Express Checkout for WooCommerce (supports Stripe, PayPal, Square, Authorize.net, NMI)

Connect and manage all your payment methods, offer shoppers a beautiful Express Checkout, and reduce cart abandonment.

v1.120.52peachpayUpdated Added 400 installs84% rating0% support resolved
20
Score
440
Errors
750
Warnings
+0
Change

Category Scores

Security0
Repo71
Performance96
Maintainability0

Issues to Review

Prioritized issue groups from the latest Plugin Check scan

1,190 findings

Maintainability

547

11 issue groups

Security

492

12 issue groups

I18n

123

2 issue groups

ERRORMaintainabilityMissing direct file access protectionPHP file should prevent direct access. Add a check like: if ( ! defined( 'ABSPATH' ) ) exit;233
Category
Maintainability
Occurrences
233
Severity
error

Sample message

PHP file should prevent direct access. Add a check like: if ( ! defined( 'ABSPATH' ) ) exit;

WARNINGSecurityMissing nonce verificationProcessing form data without nonce verification.187
Category
Security
Occurrences
187
Severity
warning

Sample message

Processing form data without nonce verification.

WARNINGMaintainabilityNon-prefixed global variableGlobal variables defined by a theme/plugin should start with the theme/plugin prefix. Found: "$accelerated_defaults".158
Category
Maintainability
Occurrences
158
Severity
warning

Sample message

Global variables defined by a theme/plugin should start with the theme/plugin prefix. Found: "$accelerated_defaults".

WARNINGSecurityRequest data is not unslashed$_GET['page'] not unslashed before sanitization. Use wp_unslash() or similar121
Category
Security
Occurrences
121
Severity
warning

Sample message

$_GET['page'] not unslashed before sanitization. Use wp_unslash() or similar

ERRORI18nMissing Translators CommentA function call to __() with texts containing placeholders was found, but was not accompanied by a "translators:" comment on the line above to clarify the meaning of the placeholders.88
Category
I18n
Occurrences
88
Severity
error

Sample message

A function call to __() with texts containing placeholders was found, but was not accompanied by a "translators:" comment on the line above to clarify the meaning of the placeholders.

WARNINGSecurityInput is not sanitizedDetected usage of a non-sanitized input variable: $_GET['page']82
Category
Security
Occurrences
82
Severity
warning

Sample message

Detected usage of a non-sanitized input variable: $_GET['page']

WARNINGMaintainabilityNon-prefixed functionFunctions declared in the global namespace by a theme/plugin should start with the theme/plugin prefix. Found: "check_if_required".65
Category
Maintainability
Occurrences
65
Severity
warning

Sample message

Functions declared in the global namespace by a theme/plugin should start with the theme/plugin prefix. Found: "check_if_required".

ERRORSecurityOutput is not escapedAll output should be run through an escaping function (see the Security sections in the WordPress Developer Handbooks), found '$available_methods'.42
Category
Security
Occurrences
42
Severity
error

Sample message

All output should be run through an escaping function (see the Security sections in the WordPress Developer Handbooks), found '$available_methods'.

ERRORI18nUnordered Placeholders TextMultiple placeholders in translatable strings should be ordered. Expected "%1$s, %2$s", but got "%s, %s" in 'Apple Pay payment authorized and awaiting confirmation. Payment ID: %s | <a href="%s" target="_blank">View Payment</a>'.35
Category
I18n
Occurrences
35
Severity
error

Sample message

Multiple placeholders in translatable strings should be ordered. Expected "%1$s, %2$s", but got "%s, %s" in 'Apple Pay payment authorized and awaiting confirmation. Payment ID: %s | <a href="%s" target="_blank">View Payment</a>'.

WARNINGMaintainabilityNon-prefixed hook nameHook names invoked by a theme/plugin should start with the theme/plugin prefix. Found: &quot;&#039;pp_checkout_form_field_&#039; . $args[&#039;type&#039;]&quot;.33
Category
Maintainability
Occurrences
33
Severity
warning

Sample message

Hook names invoked by a theme/plugin should start with the theme/plugin prefix. Found: &quot;&#039;pp_checkout_form_field_&#039; . $args[&#039;type&#039;]&quot;.

Show 15 more
WARNINGSecurityNonce verification recommended23
Category
Security
Occurrences
23
Severity
warning

Sample message

Processing form data without nonce verification.

WARNINGMaintainabilityerror log error log21
Category
Maintainability
Occurrences
21
Severity
warning

Sample message

error_log() found. Debug code should not normally be used in production.

ERRORSecuritySetting is missing a sanitization callback12
Category
Security
Occurrences
12
Severity
error

Sample message

Sanitization missing for register_setting().

WARNINGMaintainabilityDirect Query8
Category
Maintainability
Occurrences
8
Severity
warning

Sample message

Use of a direct database call is discouraged.

WARNINGMaintainabilityNon-prefixed class8
Category
Maintainability
Occurrences
8
Severity
warning

Sample message

Classes declared by a theme/plugin should start with the theme/plugin prefix. Found: &quot;ConvesioPay_ApplePay_Blocks_Support&quot;.

WARNINGMaintainabilityNo Caching7
Category
Maintainability
Occurrences
7
Severity
warning

Sample message

Direct database call without caching detected. Consider using wp_cache_get() / wp_cache_set() or wp_cache_delete().

ERRORSecurityException output is not escaped7
Category
Security
Occurrences
7
Severity
error

Sample message

All output should be run through an escaping function (see the Security sections in the WordPress Developer Handbooks), found '$message'.

WARNINGMaintainabilityslow db query meta query6
Category
Maintainability
Occurrences
6
Severity
warning

Sample message

Detected usage of meta_query, possible slow query.

ERRORSecuritySQL query is not prepared4
Category
Security
Occurrences
4
Severity
error

Sample message

Use placeholders and $wpdb->prepare(); found $sql_with_description

WARNINGSecurityUnfinished Prepare4
Category
Security
Occurrences
4
Severity
warning

Sample message

Replacement variables found, but no valid placeholders found in the query.

WARNINGMaintainabilityslow db query meta key4
Category
Maintainability
Occurrences
4
Severity
warning

Sample message

Detected usage of meta_key, possible slow query.

WARNINGMaintainabilityslow db query meta value4
Category
Maintainability
Occurrences
4
Severity
warning

Sample message

Detected usage of meta_value, possible slow query.

ERRORSecurityUnsafe printing function4
Category
Security
Occurrences
4
Severity
error

Sample message

All output should be run through an escaping function (like esc_html_e() or esc_attr_e()), found '_e'.

ERRORSecurityDatabase parameter is not escaped3
Category
Security
Occurrences
3
Severity
error

Sample message

Unescaped parameter $sql_with_description used in $wpdb->get_results()\n$sql_with_description assigned unsafely at line 1506.

WARNINGSecurityInterpolated SQL is not prepared3
Category
Security
Occurrences
3
Severity
warning

Sample message

Use placeholders and $wpdb-&gt;prepare(); found interpolated variable {$table_name} at &quot;SELECT customer_id, stored_payment_methods, email, default_payment_method_id, updated_at FROM {$table_name} WHERE customer_id = %s&quot;

External Connections

Potential connections found in static code analysis.

80 domains

Outbound calls

232

External assets

8

Incoming endpoints

60

Notable Domains

api.convesiopay.com19 · outbound
convesiopay.com10 · outbound
peachpay.app10 · outbound
woocommerce.com9 · outbound
paypal.com8 · outbound

Platform / Reference Domains

w3.org13 · platform/reference
wordpress.org5 · platform/reference
github.com3 · platform/reference
developer.wordpress.org1 · platform/reference
gnu.org1 · platform/reference

External Asset Domains

js.convesiopay.com8 · asset + outbound
cdn.rawgit.com3 · asset + outbound
cdnjs.cloudflare.com3 · asset + outbound

Incoming Endpoints

/wp-json/peachpay/v1/convesiopay/configREST

register_rest_route

/wp-json/peachpay/v1/convesiopay/webhookREST

register_rest_route

wp_ajax_nopriv_peachpay_ajax_loginpublic

wp_ajax

wp_ajax_nopriv_peachpay_convesiopay_blocks_set_chosen_payment_methodpublic

wp_ajax

wp_ajax_nopriv_peachpay_convesiopay_check_btcpay_statuspublic

wp_ajax

wp_ajax_nopriv_peachpay_convesiopay_create_btcpay_intentpublic

wp_ajax

Admin AJAX endpoints51
wp_ajax_test_convesiopay_gateway_classauthenticated

wp_ajax

admin_post_peachpay_download_logsauthenticated

admin_post

wp_ajax_convesiopay_manual_syncauthenticated

wp_ajax

wp_ajax_peachpay_authnet_delete_credentialsauthenticated

wp_ajax

wp_ajax_peachpay_authnet_save_credentialsauthenticated

wp_ajax

wp_ajax_peachpay_authnet_set_enabledauthenticated

wp_ajax

wp_ajax_peachpay_convesiopay_blocks_set_chosen_payment_methodauthenticated

wp_ajax

wp_ajax_peachpay_convesiopay_cancel_paymentauthenticated

wp_ajax

wp_ajax_peachpay_convesiopay_cancel_subscription_migrationauthenticated

wp_ajax

wp_ajax_peachpay_convesiopay_capture_paymentauthenticated

wp_ajax

wp_ajax_peachpay_convesiopay_check_btcpay_statusauthenticated

wp_ajax

wp_ajax_peachpay_convesiopay_clear_subscription_migration_logsauthenticated

wp_ajax

39 more hidden

Score History

First score snapshot

v1.120.52

20

Latest

Findings
1,190
Errors
440
Warnings
750
Check
2.0.0

Relationship Map

Author, categories, issues, domains, and nearby plugins.

37 nodes

Related Plugins