Auto-publish posts, pages & CPTs, plus manage Google Business Profile posts. All from your WordPress dashboard!
Category Scores
Top Issues by Category
maintainability1,336
security907
Issues Details
2,297 issues found in latest scan
Global variables defined by a theme/plugin should start with the theme/plugin prefix. Found: "$account_addon_ids".
All output should be run through an escaping function (see the Security sections in the WordPress Developer Handbooks), found '" <a href='{$skip_url}' class='button button-small button-secondary'>{$use_plugin_anonymously_text}</a>"'.
Functions declared in the global namespace by a theme/plugin should start with the theme/plugin prefix. Found: "_fs_text".
All output should be run through an escaping function (see the Security sections in the WordPress Developer Handbooks), found '$data'.
All output should be run through an escaping function (like esc_html_e() or esc_attr_e()), found '_e'.
Classes declared by a theme/plugin should start with the theme/plugin prefix. Found: "FS_Admin_Menu_Manager".
Detected usage of a possibly undefined superglobal array index: $_POST['mbp_data_mode']. Check that the array index exists before using it.
$_POST['mbp_create_post'] not unslashed before sanitization. Use wp_unslash() or similar
Global constants defined by a theme/plugin should start with the theme/plugin prefix. Found: "FS_API__ADDRESS".
Detected usage of a non-sanitized input variable: $_POST['mbp_create_post']
Hook names invoked by a theme/plugin should start with the theme/plugin prefix. Found: "fs_plugins_api".
Processing form data without nonce verification.
Direct database call without caching detected. Consider using wp_cache_get() / wp_cache_set() or wp_cache_delete().
Function "wp_date()" requires WordPress 5.3.0, but your plugin minimum supported version is WordPress 4.9.0.
Use placeholders and $wpdb->prepare(); found interpolated variable $this->table at "SELECT * FROM $this->table WHERE account_id = %s AND in_latest_import=1 LIMIT %d OFFSET %d"
Processing form data without nonce verification.
PHP file should prevent direct access. Add a check like: if ( ! defined( 'ABSPATH' ) ) exit;
Resource version not set in call to wp_enqueue_script(). This means new versions of the script may not always be loaded due to browser caching.
Detected usage of meta_query, possible slow query.
Attempting a database schema change is discouraged.
A function call to __() with texts containing placeholders was found, but was not accompanied by a "translators:" comment on the line above to clarify the meaning of the placeholders.
Unescaped parameter $implode_placeholders used in $wpdb->query()\n$implode_placeholders assigned unsafely at line 122.
| Code | Type | Message | Count |
|---|---|---|---|
| WordPress.NamingConventions.PrefixAllGlobals.NonPrefixedVariableFound | WARNING | Global variables defined by a theme/plugin should start with the theme/plugin prefix. Found: "$account_addon_ids". | 1,084 |
| WordPress.Security.EscapeOutput.OutputNotEscaped | ERROR | All output should be run through an escaping function (see the Security sections in the WordPress Developer Handbooks), found '" <a href='{$skip_url}' class='button button-small button-secondary'>{$use_plugin_anonymously_text}</a>"'. | 639 |
| WordPress.NamingConventions.PrefixAllGlobals.NonPrefixedFunctionFound | WARNING | Functions declared in the global namespace by a theme/plugin should start with the theme/plugin prefix. Found: "_fs_text". | 99 |
| WordPress.Security.EscapeOutput.ExceptionNotEscaped | ERROR | All output should be run through an escaping function (see the Security sections in the WordPress Developer Handbooks), found '$data'. | 72 |
| WordPress.Security.EscapeOutput.UnsafePrintingFunction | ERROR | All output should be run through an escaping function (like esc_html_e() or esc_attr_e()), found '_e'. | 53 |
| WordPress.NamingConventions.PrefixAllGlobals.NonPrefixedClassFound | WARNING | Classes declared by a theme/plugin should start with the theme/plugin prefix. Found: "FS_Admin_Menu_Manager". | 45 |
| WordPress.Security.ValidatedSanitizedInput.InputNotValidated | WARNING | Detected usage of a possibly undefined superglobal array index: $_POST['mbp_data_mode']. Check that the array index exists before using it. | 31 |
| WordPress.Security.ValidatedSanitizedInput.MissingUnslash | WARNING | $_POST['mbp_create_post'] not unslashed before sanitization. Use wp_unslash() or similar | 28 |
| WordPress.NamingConventions.PrefixAllGlobals.NonPrefixedConstantFound | WARNING | Global constants defined by a theme/plugin should start with the theme/plugin prefix. Found: "FS_API__ADDRESS". | 26 |
| WordPress.Security.ValidatedSanitizedInput.InputNotSanitized | WARNING | Detected usage of a non-sanitized input variable: $_POST['mbp_create_post'] | 24 |
| WordPress.DB.PreparedSQL.NotPrepared | ERROR | Use placeholders and $wpdb->prepare(); found $account_id | 22 |
| WordPress.NamingConventions.PrefixAllGlobals.NonPrefixedHooknameFound | WARNING | Hook names invoked by a theme/plugin should start with the theme/plugin prefix. Found: "fs_plugins_api". | 18 |
| WordPress.Security.NonceVerification.Recommended | WARNING | Processing form data without nonce verification. | 18 |
| WordPress.DB.DirectDatabaseQuery.DirectQuery | WARNING | Use of a direct database call is discouraged. | 14 |
| WordPress.WP.I18n.MissingArgDomain | ERROR | Missing $domain parameter in function call to __(). | 14 |
| WordPress.DB.DirectDatabaseQuery.NoCaching | WARNING | Direct database call without caching detected. Consider using wp_cache_get() / wp_cache_set() or wp_cache_delete(). | 13 |
| wp_function_not_compatible_with_requires_wp | ERROR | Function "wp_date()" requires WordPress 5.3.0, but your plugin minimum supported version is WordPress 4.9.0. | 13 |
| WordPress.DB.PreparedSQL.InterpolatedNotPrepared | WARNING | Use placeholders and $wpdb->prepare(); found interpolated variable $this->table at "SELECT * FROM $this->table WHERE account_id = %s AND in_latest_import=1 LIMIT %d OFFSET %d" | 9 |
| WordPress.Security.NonceVerification.Missing | WARNING | Processing form data without nonce verification. | 8 |
| missing_direct_file_access_protection | ERROR | PHP file should prevent direct access. Add a check like: if ( ! defined( 'ABSPATH' ) ) exit; | 8 |
| WordPress.WP.EnqueuedResourceParameters.MissingVersion | WARNING | Resource version not set in call to wp_enqueue_script(). This means new versions of the script may not always be loaded due to browser caching. | 7 |
| WordPress.DB.SlowDBQuery.slow_db_query_meta_query | WARNING | Detected usage of meta_query, possible slow query. | 5 |
| WordPress.DB.DirectDatabaseQuery.SchemaChange | WARNING | Attempting a database schema change is discouraged. | 4 |
| WordPress.WP.I18n.MissingTranslatorsComment | ERROR | A function call to __() with texts containing placeholders was found, but was not accompanied by a "translators:" comment on the line above to clarify the meaning of the placeholders. | 4 |
| PluginCheck.Security.DirectDB.UnescapedDBParameter | ERROR | Unescaped parameter $implode_placeholders used in $wpdb->query()\n$implode_placeholders assigned unsafely at line 122. | 3 |
Latest Snapshot
Findings
2,297
Errors
845
Warnings
1,452
Score History
First score snapshot
First scan completed
v3.4.4 · Plugin Check 2.0.0 · Model 2026.06-mvp-static-v2
v3.4.4
23
Latest
- Findings
- 2,297
- Errors
- 845
- Warnings
- 1,452
- Plugin Check
- 2.0.0
- Model
- 2026.06-mvp-static-v2
| Scan | Score | Findings | Errors | Warnings | Plugin | Plugin Check | Model |
|---|---|---|---|---|---|---|---|
| Latest | 23 | 2,297 | 845 | 1,452 | v3.4.4 | 2.0.0 | 2026.06-mvp-static-v2 |