200+ MCP tools. OAuth 2.0 + WebMCP. Connect Claude, ChatGPT, Gemini, Cursor & any MCP agent to your WordPress site. 100% self-hosted.
37
Score
47
Errors
131
Warnings
+0
Change
Category Scores
Security0
Repo100
Performance100
Maintainability59
Issues to Review
Prioritized issue groups from the latest Plugin Check scan
Security
88
9 issue groups
Maintainability
87
15 issue groups
I18n
2
1 issue group
WARNINGSecurityInterpolated SQL is not preparedUse placeholders and $wpdb->prepare(); found interpolated variable $table at "SELECT `id` AS ID, `name`, `hash`, `status`, `created`, `owner`, `package` FROM `$table` WHERE `id` = %d"28
- Category
- Security
- Occurrences
- 28
- Severity
- warning
Sample message
Use placeholders and $wpdb->prepare(); found interpolated variable $table at "SELECT `id` AS ID, `name`, `hash`, `status`, `created`, `owner`, `package` FROM `$table` WHERE `id` = %d"
WARNINGMaintainabilityNon-prefixed global variableGlobal variables defined by a theme/plugin should start with the theme/plugin prefix. Found: "$btn_style".22
- Category
- Maintainability
- Occurrences
- 22
- Severity
- warning
Sample message
Global variables defined by a theme/plugin should start with the theme/plugin prefix. Found: "$btn_style".
WARNINGMaintainabilityDirect QueryUse of a direct database call is discouraged.14
- Category
- Maintainability
- Occurrences
- 14
- Severity
- warning
Sample message
Use of a direct database call is discouraged.
ERRORSecurityException output is not escapedAll output should be run through an escaping function (see the Security sections in the WordPress Developer Handbooks), found '$class'.14
- Category
- Security
- Occurrences
- 14
- Severity
- error
Sample message
All output should be run through an escaping function (see the Security sections in the WordPress Developer Handbooks), found '$class'.
ERRORSecurityOutput is not escapedAll output should be run through an escaping function (see the Security sections in the WordPress Developer Handbooks), found '$install_target'.14
- Category
- Security
- Occurrences
- 14
- Severity
- error
Sample message
All output should be run through an escaping function (see the Security sections in the WordPress Developer Handbooks), found '$install_target'.
WARNINGSecurityDatabase parameter is not escapedUnescaped parameter $auth_codes_table used in $wpdb->query()\n$auth_codes_table assigned unsafely at line 477.13
- Category
- Security
- Occurrences
- 13
- Severity
- warning
Sample message
Unescaped parameter $auth_codes_table used in $wpdb->query()\n$auth_codes_table assigned unsafely at line 477.
WARNINGMaintainabilityerror log error logerror_log() found. Debug code should not normally be used in production.11
- Category
- Maintainability
- Occurrences
- 11
- Severity
- warning
Sample message
error_log() found. Debug code should not normally be used in production.
WARNINGMaintainabilityNo CachingDirect database call without caching detected. Consider using wp_cache_get() / wp_cache_set() or wp_cache_delete().10
- Category
- Maintainability
- Occurrences
- 10
- Severity
- warning
Sample message
Direct database call without caching detected. Consider using wp_cache_get() / wp_cache_set() or wp_cache_delete().
ERRORSecurityUnsupported Identifier PlaceholderThe %i modifier is only supported in WP 6.2 or higher. Found: "%i".7
- Category
- Security
- Occurrences
- 7
- Severity
- error
Sample message
The %i modifier is only supported in WP 6.2 or higher. Found: "%i".
WARNINGMaintainabilityslow db query meta keyDetected usage of meta_key, possible slow query.7
- Category
- Maintainability
- Occurrences
- 7
- Severity
- warning
Sample message
Detected usage of meta_key, possible slow query.
Show 15 moreShow less
WARNINGMaintainabilityNon-prefixed hook name5
- Category
- Maintainability
- Occurrences
- 5
- Severity
- warning
Sample message
Hook names invoked by a theme/plugin should start with the theme/plugin prefix. Found: "post_updated".
WARNINGMaintainabilityDirect Integration4
- Category
- Maintainability
- Occurrences
- 4
- Severity
- warning
Sample message
Direct integration with a third-party AI provider (api.anthropic.com) detected. Consider the WordPress AI Client (wp_ai_client_prompt()) introduced in WordPress 7.0.
ERRORSecuritySQL query is not prepared4
- Category
- Security
- Occurrences
- 4
- Severity
- error
Sample message
Use placeholders and $wpdb->prepare(); found $prepared
WARNINGMaintainabilityslow db query meta query4
- Category
- Maintainability
- Occurrences
- 4
- Severity
- warning
Sample message
Detected usage of meta_query, possible slow query.
WARNINGSecurityUnfinished Prepare3
- Category
- Security
- Occurrences
- 3
- Severity
- warning
Sample message
Replacement variables found, but no valid placeholders found in the query.
WARNINGMaintainabilityslow db query tax query3
- Category
- Maintainability
- Occurrences
- 3
- Severity
- warning
Sample message
Detected usage of tax_query, possible slow query.
WARNINGSecurityNonce verification recommended3
- Category
- Security
- Occurrences
- 3
- Severity
- warning
Sample message
Processing form data without nonce verification.
ERRORSecurityDatabase parameter is not escaped2
- Category
- Security
- Occurrences
- 2
- Severity
- error
Sample message
Unescaped parameter $prepared used in $wpdb->get_col()\n$prepared assigned unsafely at line 866.
ERRORI18nMissing Translators Comment2
- Category
- I18n
- Occurrences
- 2
- Severity
- error
Sample message
A function call to __() with texts containing placeholders was found, but was not accompanied by a "translators:" comment on the line above to clarify the meaning of the placeholders.
ERRORMaintainabilitywp function not compatible with requires wp2
- Category
- Maintainability
- Occurrences
- 2
- Severity
- error
Sample message
Function "str_starts_with()" requires WordPress 5.9.0, but your plugin minimum supported version is WordPress 5.8.0.
WARNINGMaintainabilitySchema Change1
- Category
- Maintainability
- Occurrences
- 1
- Severity
- warning
Sample message
Attempting a database schema change is discouraged.
WARNINGMaintainabilityDynamic hook name1
- Category
- Maintainability
- Occurrences
- 1
- Severity
- warning
Sample message
Hook names invoked by a theme/plugin should start with the theme/plugin prefix. Found: "$event".
ERRORMaintainabilityfile system operations fclose1
- Category
- Maintainability
- Occurrences
- 1
- Severity
- error
Sample message
File operations should use WP_Filesystem methods instead of direct PHP filesystem calls. Found: fclose().
ERRORMaintainabilityfile system operations fopen1
- Category
- Maintainability
- Occurrences
- 1
- Severity
- error
Sample message
File operations should use WP_Filesystem methods instead of direct PHP filesystem calls. Found: fopen().
WARNINGMaintainabilityMissing Version1
- Category
- Maintainability
- Occurrences
- 1
- Severity
- warning
Sample message
Resource version not set in call to wp_enqueue_style(). This means new versions of the style may not always be loaded due to browser caching.
External Connections
Potential connections found in static code analysis.
Outbound calls
87
External assets
1
Incoming endpoints
13
Notable Domains
royalplugins.com46 · outbound
yoursite.com3 · outbound
console.anthropic.com2 · outbound
console.groq.com2 · outbound
platform.openai.com2 · outbound
ai.google.dev1 · outbound
Platform / Reference Domains
schema.org5 · platform/reference
wordpress.org5 · platform/reference
github.com1 · platform/reference
gnu.org1 · platform/reference
w3.org1 · platform/reference
External Asset Domains
fonts.googleapis.com2 · asset + outbound
Incoming Endpoints
/wp-json/royal-mcp/v1REST
register_rest_route
/wp-json/royal-mcp/v1/.well-known/oauth-authorization-serverREST
register_rest_route
/wp-json/royal-mcp/v1/.well-known/oauth-protected-resourceREST
register_rest_route
/wp-json/royal-mcp/v1/diagnostics/header-echoREST
register_rest_route
/wp-json/royal-mcp/v1/discovery/agent-skillsREST
register_rest_route
/wp-json/royal-mcp/v1/discovery/server-cardREST
register_rest_route
Admin AJAX endpoints4
wp_ajax_royal_mcp_clear_oauth_fieldauthenticated
wp_ajax
wp_ajax_royal_mcp_reset_oauth_stateauthenticated
wp_ajax
wp_ajax_royal_mcp_revoke_all_sessionsauthenticated
wp_ajax
wp_ajax_royal_mcp_test_connectionauthenticated
wp_ajax
Score History
20 score snapshots
v1.5.2
37
Latest
- Findings
- 178
- Errors
- 47
- Warnings
- 131
- Check
- 2.1.0
v1.5.1
37
Score
- Findings
- 161
- Errors
- 47
- Warnings
- 114
- Check
- 2.1.0
| Scan | Score | Findings | Errors | Warnings | Plugin | Check |
|---|---|---|---|---|---|---|
| Latest | 37 | 178 | 47 | 131 | v1.5.2 | 2.1.0 |
| 37 | 161 | 47 | 114 | v1.5.1 | 2.1.0 |
Relationship Map
Author, categories, issues, domains, and nearby plugins.
Loading map
PluginAuthorCategoryIssueDomainRelated
Relationship links
Author
Issue
Domain
Related
Elementor Website Builder – more than just a page builder39 scoreYoast SEO – Advanced SEO with real-time guidance and built-in AI24 scoreWooCommerce22 scoreContact Form 769 scoreLiteSpeed Cache35 scoreWordfence Security – Firewall, Malware Scan, and Login Security21 scoreAkismet Anti-spam: Spam Protection35 scoreRank Math SEO – AI SEO Tools to Dominate SEO Rankings29 scoreReally Simple Security – Simple and Performant Security (formerly Really Simple SSL)19 scoreAll-In-One Security (AIOS) – Security and Firewall24 scoreAll in One SEO – AI SEO Plugin to Boost SEO Rankings & Traffic (Schema, Local SEO, Sitemap & SEO Insights)94 scoreUltimate Addons for Elementor – Widgets, Templates, WooCommerce & Header Footer Builder33 scoreAI Agent by SiteGround53 scoreEssential Addons for Elementor – Popular Elementor Templates & Widgets28 score
Author
Issue
Domain
Related
Elementor Website Builder – more than just a page builder39 scoreYoast SEO – Advanced SEO with real-time guidance and built-in AI24 scoreWooCommerce22 scoreContact Form 769 scoreLiteSpeed Cache35 scoreWordfence Security – Firewall, Malware Scan, and Login Security21 scoreAkismet Anti-spam: Spam Protection35 scoreRank Math SEO – AI SEO Tools to Dominate SEO Rankings29 scoreReally Simple Security – Simple and Performant Security (formerly Really Simple SSL)19 scoreAll-In-One Security (AIOS) – Security and Firewall24 scoreAll in One SEO – AI SEO Plugin to Boost SEO Rankings & Traffic (Schema, Local SEO, Sitemap & SEO Insights)94 scoreUltimate Addons for Elementor – Widgets, Templates, WooCommerce & Header Footer Builder33 scoreAI Agent by SiteGround53 scoreEssential Addons for Elementor – Popular Elementor Templates & Widgets28 score
Related Plugins
Input Mask For Elementor Form Fields
20k+ active installs
100
AI Puffer – Chat. Create. Automate. (formerly AI Power)
10k+ active installs
100
Selection Lite
9k+ active installs
100
Blogmentor – Blog Layouts for Elementor
4k+ active installs
100
VigIA – AI Visibility, Analytics & Control
1k+ active installs
100
Share Buttons & AI-powered Summaries
1k+ active installs
100