PluginScore

Stars Rating

A complete review plugin — star ratings, photo uploads, likes & dislikes, and Google rich snippets, all from one place.

v4.1.0Fahid JavidUpdated Added 1k+ installs94% rating0% support resolved
commentsratingreviewsshortcodestars
46
Score
13
Errors
34
Warnings
+0
Change

Category Scores

Security12
Repo80
Performance100
Maintainability87

Issues to Review

Prioritized issue groups from the latest Plugin Check scan

47 findings

Security

31

5 issue groups

Maintainability

11

8 issue groups

Repo Compliance

4

4 issue groups

I18n

1

1 issue group

WARNINGSecurityMissing nonce verificationProcessing form data without nonce verification.9
Category
Security
Occurrences
9
Severity
warning

Sample message

Processing form data without nonce verification.

WordPress.Security.NonceVerification.Missing
ERRORSecurityOutput is not escapedAll output should be run through an escaping function (see the Security sections in the WordPress Developer Handbooks), found '$ajax_url'.8
Category
Security
Occurrences
8
Severity
error

Sample message

All output should be run through an escaping function (see the Security sections in the WordPress Developer Handbooks), found '$ajax_url'.

WordPress.Security.EscapeOutput.OutputNotEscapedReference
WARNINGSecurityNonce verification recommendedProcessing form data without nonce verification.6
Category
Security
Occurrences
6
Severity
warning

Sample message

Processing form data without nonce verification.

WordPress.Security.NonceVerification.Recommended
WARNINGSecurityInput is not sanitizedDetected usage of a non-sanitized input variable: $_FILES['sr_review_images']5
Category
Security
Occurrences
5
Severity
warning

Sample message

Detected usage of a non-sanitized input variable: $_FILES['sr_review_images']

WordPress.Security.ValidatedSanitizedInput.InputNotSanitized
WARNINGMaintainabilityNon-prefixed constantGlobal constants defined by a theme/plugin should start with the theme/plugin prefix. Found: "PLUGIN_ADMIN_URL".3
Category
Maintainability
Occurrences
3
Severity
warning

Sample message

Global constants defined by a theme/plugin should start with the theme/plugin prefix. Found: "PLUGIN_ADMIN_URL".

WordPress.NamingConventions.PrefixAllGlobals.NonPrefixedConstantFound
WARNINGSecurityRequest data is not unslashed$_GET['order'] not unslashed before sanitization. Use wp_unslash() or similar3
Category
Security
Occurrences
3
Severity
warning

Sample message

$_GET['order'] not unslashed before sanitization. Use wp_unslash() or similar

WordPress.Security.ValidatedSanitizedInput.MissingUnslash
WARNINGMaintainabilityNot In FooterIn footer ($in_footer) is not set explicitly wp_enqueue_script; It is recommended to load scripts in the footer. Please set this value to `true` to load it in the footer, or explicitly `false` if it should be loaded in the header.2
Category
Maintainability
Occurrences
2
Severity
warning

Sample message

In footer ($in_footer) is not set explicitly wp_enqueue_script; It is recommended to load scripts in the footer. Please set this value to `true` to load it in the footer, or explicitly `false` if it should be loaded in the header.

WordPress.WP.EnqueuedResourceParameters.NotInFooter
ERRORMaintainabilityForbidden PHP function foundThe use of function move_uploaded_file() is forbidden1
Category
Maintainability
Occurrences
1
Severity
error

Sample message

The use of function move_uploaded_file() is forbidden

Generic.PHP.ForbiddenFunctions.Found
WARNINGI18nDiscouraged text-domain loadingload_plugin_textdomain() has been discouraged since WordPress version 4.6. When your plugin is hosted on WordPress.org, you no longer need to manually include this function call for translations under your plugin slug. WordPress will automatically load the translations for you as needed.1
Category
I18n
Occurrences
1
Severity
warning

Sample message

load_plugin_textdomain() has been discouraged since WordPress version 4.6. When your plugin is hosted on WordPress.org, you no longer need to manually include this function call for translations under your plugin slug. WordPress will automatically load the translations for you as needed.

PluginCheck.CodeAnalysis.DiscouragedFunctions.load_plugin_textdomainFoundReference
WARNINGMaintainabilityDirect QueryUse of a direct database call is discouraged.1
Category
Maintainability
Occurrences
1
Severity
warning

Sample message

Use of a direct database call is discouraged.

WordPress.DB.DirectDatabaseQuery.DirectQuery
Show 8 more
WARNINGMaintainabilityNo Caching1
Category
Maintainability
Occurrences
1
Severity
warning

Sample message

Direct database call without caching detected. Consider using wp_cache_get() / wp_cache_set() or wp_cache_delete().

WordPress.DB.DirectDatabaseQuery.NoCaching
WARNINGMaintainabilityslow db query meta query1
Category
Maintainability
Occurrences
1
Severity
warning

Sample message

Detected usage of meta_query, possible slow query.

WordPress.DB.SlowDBQuery.slow_db_query_meta_query
WARNINGMaintainabilityNon-prefixed hook name1
Category
Maintainability
Occurrences
1
Severity
warning

Sample message

Hook names invoked by a theme/plugin should start with the theme/plugin prefix. Found: "star_ratings_loaded".

WordPress.NamingConventions.PrefixAllGlobals.NonPrefixedHooknameFound
ERRORMaintainabilityMissing direct file access protection1
Category
Maintainability
Occurrences
1
Severity
error

Sample message

PHP file should prevent direct access. Add a check like: if ( ! defined( 'ABSPATH' ) ) exit;

missing_direct_file_access_protectionReference
ERRORRepo Complianceoutdated tested upto header1
Category
Repo Compliance
Occurrences
1
Severity
error

Sample message

Tested up to: 6.9 < 7.0. The "Tested up to" value in your plugin is not set to the current version of WordPress. This means your plugin will not show up in searches, as we require plugins to be compatible and documented as tested up to the most recent version of WordPress.

outdated_tested_upto_headerReference
WARNINGRepo Complianceplugin header invalid domain path1
Category
Repo Compliance
Occurrences
1
Severity
warning

Sample message

The "Domain Path" header in the plugin file must start with forward slash.

plugin_header_invalid_domain_pathReference
ERRORRepo Complianceplugin header no license1
Category
Repo Compliance
Occurrences
1
Severity
error

Sample message

Missing "License" in Plugin Header. Please update your Plugin Header with a valid GPLv2 (or later) compatible license.

plugin_header_no_licenseReference
ERRORRepo Compliancereadme mismatched header requires php1
Category
Repo Compliance
Occurrences
1
Severity
error

Sample message

Mismatched Requires PHP: 8.3 != 7.4. "Requires PHP" needs to be exactly the same with that in your main plugin file's header.

readme_mismatched_header_requires_phpReference

External Connections

Potential connections found in static code analysis.

6 domains

Outbound calls

12

External assets

0

Incoming endpoints

3

Notable Domains

fahidjavid.com2 · outbound
fontawesome.io2 · outbound
developers.google.com1 · outbound

Platform / Reference Domains

w3.org4 · platform/reference
wordpress.org2 · platform/reference
schema.org1 · platform/reference

External Asset Domains

No external asset domains detected.

Incoming Endpoints

wp_ajax_nopriv_sr_votepublic

wp_ajax

Admin AJAX endpoints2
wp_ajax_sr_delete_review_photoauthenticated

wp_ajax

wp_ajax_sr_voteauthenticated

wp_ajax

Score History

First score snapshot

v4.1.0

46

Latest

Findings
47
Errors
13
Warnings
34
Check
2.0.0

Relationship Map

Author, categories, issues, domains, and nearby plugins.

32 nodes

Related Plugins

Coupon Shortcodes for WooCommerce

1k+ active installs

100
Current Year Shortcode VICT

900 active installs

100
Email addon for CF7

3k+ active installs

100
Events Shortcodes For The Events Calendar

10k+ active installs

100
Menu In Post

2k+ active installs

100
Really Simple Disable Comments

400 active installs

100