Obtain GDPR (DSGVO/RGPD) and ePrivacy Directive (TDDDG/TTDSG, LOPD-GDD, DTA) compliant consents in your cookie banner. More than just a cookie notice!
Category Scores
Top Issues by Category
maintainability330
Issues Details
505 issues found in latest scan
Unescaped parameter $expressionSql used in $wpdb->get_results()\n$expressionSql assigned unsafely at line 211.
Direct database call without caching detected. Consider using wp_cache_get() / wp_cache_set() or wp_cache_delete().
Hook names invoked by a theme/plugin should start with the theme/plugin prefix. Found: "'RCB/Migration/' . $migrationId . '/' . $actionId".
Processing form data without nonce verification.
Global constants defined by a theme/plugin should start with the theme/plugin prefix. Found: "RCB_DB_PREFIX".
Attempting a database schema change is discouraged.
Detected usage of meta_query, possible slow query.
Functions declared in the global namespace by a theme/plugin should start with the theme/plugin prefix. Found: "rcb_skip_already_admin_notice".
Global variables defined by a theme/plugin should start with the theme/plugin prefix. Found: "$apiInclude".
parse_url() is discouraged because of inconsistency in the output across PHP versions; use wp_parse_url() instead.
Detected usage of tax_query, possible slow query.
debug_backtrace() found. Debug code should not normally be used in production.
Unexpected markdown file "LICENSE_3RD_PARTY_JS.md" detected in plugin root. Only specific markdown files are expected in production plugins.
Detected usage of meta_key, possible slow query.
Detected usage of meta_value, possible slow query.
File operations should use WP_Filesystem methods instead of direct PHP filesystem calls. Found: fwrite().
mt_rand() is discouraged. Use the far less predictable wp_rand() instead.
Scripts must be registered/enqueued via wp_enqueue_script()
Plugin name "Real Cookie Banner: GDPR & ePrivacy Cookie Consent" is different from the name declared in plugin header "Real Cookie Banner (Free)".
The "/vendor" directory using composer exists, but "composer.json" file is missing.
PHP file should prevent direct access. Add a check like: if ( ! defined( 'ABSPATH' ) ) exit;
| Code | Type | Message | Count |
|---|---|---|---|
| PluginCheck.Security.DirectDB.UnescapedDBParameter | WARNING | Unescaped parameter $expressionSql used in $wpdb->get_results()\n$expressionSql assigned unsafely at line 211. | 111 |
| WordPress.DB.DirectDatabaseQuery.DirectQuery | WARNING | Use of a direct database call is discouraged. | 92 |
| WordPress.DB.DirectDatabaseQuery.NoCaching | WARNING | Direct database call without caching detected. Consider using wp_cache_get() / wp_cache_set() or wp_cache_delete(). | 84 |
| WordPress.NamingConventions.PrefixAllGlobals.NonPrefixedHooknameFound | WARNING | Hook names invoked by a theme/plugin should start with the theme/plugin prefix. Found: "'RCB/Migration/' . $migrationId . '/' . $actionId". | 69 |
| WordPress.Security.NonceVerification.Recommended | WARNING | Processing form data without nonce verification. | 64 |
| WordPress.NamingConventions.PrefixAllGlobals.NonPrefixedConstantFound | WARNING | Global constants defined by a theme/plugin should start with the theme/plugin prefix. Found: "RCB_DB_PREFIX". | 27 |
| WordPress.DB.DirectDatabaseQuery.SchemaChange | WARNING | Attempting a database schema change is discouraged. | 12 |
| WordPress.DB.SlowDBQuery.slow_db_query_meta_query | WARNING | Detected usage of meta_query, possible slow query. | 10 |
| WordPress.NamingConventions.PrefixAllGlobals.NonPrefixedFunctionFound | WARNING | Functions declared in the global namespace by a theme/plugin should start with the theme/plugin prefix. Found: "rcb_skip_already_admin_notice". | 10 |
| WordPress.NamingConventions.PrefixAllGlobals.NonPrefixedVariableFound | WARNING | Global variables defined by a theme/plugin should start with the theme/plugin prefix. Found: "$apiInclude". | 6 |
| WordPress.WP.AlternativeFunctions.parse_url_parse_url | ERROR | parse_url() is discouraged because of inconsistency in the output across PHP versions; use wp_parse_url() instead. | 5 |
| WordPress.DB.SlowDBQuery.slow_db_query_tax_query | WARNING | Detected usage of tax_query, possible slow query. | 2 |
| WordPress.PHP.DevelopmentFunctions.error_log_debug_backtrace | WARNING | debug_backtrace() found. Debug code should not normally be used in production. | 2 |
| unexpected_markdown_file | WARNING | Unexpected markdown file "LICENSE_3RD_PARTY_JS.md" detected in plugin root. Only specific markdown files are expected in production plugins. | 2 |
| WordPress.DB.SlowDBQuery.slow_db_query_meta_key | WARNING | Detected usage of meta_key, possible slow query. | 1 |
| WordPress.DB.SlowDBQuery.slow_db_query_meta_value | WARNING | Detected usage of meta_value, possible slow query. | 1 |
| WordPress.WP.AlternativeFunctions.file_system_operations_fwrite | ERROR | File operations should use WP_Filesystem methods instead of direct PHP filesystem calls. Found: fwrite(). | 1 |
| WordPress.WP.AlternativeFunctions.rand_mt_rand | ERROR | mt_rand() is discouraged. Use the far less predictable wp_rand() instead. | 1 |
| WordPress.WP.EnqueuedResources.NonEnqueuedScript | ERROR | Scripts must be registered/enqueued via wp_enqueue_script() | 1 |
| mismatched_plugin_name | WARNING | Plugin name "Real Cookie Banner: GDPR & ePrivacy Cookie Consent" is different from the name declared in plugin header "Real Cookie Banner (Free)". | 1 |
| missing_composer_json_file | WARNING | The "/vendor" directory using composer exists, but "composer.json" file is missing. | 1 |
| missing_direct_file_access_protection | ERROR | PHP file should prevent direct access. Add a check like: if ( ! defined( 'ABSPATH' ) ) exit; | 1 |
| upgrade_notice_limit | WARNING | The upgrade notice for "5.0" exceeds the limit of 300 characters. | 1 |
Latest Snapshot
Findings
505
Errors
9
Warnings
496
Score History
First score snapshot
First scan completed Jun 19, 2026
v5.2.25 · Plugin Check 2.0.0 · Model 2026.06-mvp-static-v2
Jun 19, 2026
v5.2.25
30
Latest
- Findings
- 505
- Errors
- 9
- Warnings
- 496
- Plugin Check
- 2.0.0
- Model
- 2026.06-mvp-static-v2
| Scan | Score | Findings | Errors | Warnings | Plugin | Plugin Check | Model |
|---|---|---|---|---|---|---|---|
| Jun 19, 2026Latest | 30 | 505 | 9 | 496 | v5.2.25 | 2.0.0 | 2026.06-mvp-static-v2 |
