Ultimate Post Kit Addons for Elementor

Build your blogs and news sites with a feature-rich Elementor addon, offering 100+ elements for engaging layouts.

v4.1.15bdthemesUpdated Added 30k+ installs96% rating100% support resolved
25
Score
182
Errors
412
Warnings
+0
Change

Category Scores

Security0
Repo62
Performance78
Maintainability38

Issues to Review

Prioritized issue groups from the latest Plugin Check scan

594 findings

Security

362

8 issue groups

Maintainability

104

11 issue groups

Performance

62

2 issue groups

I18n

41

3 issue groups

WARNINGSecurityMissing nonce verificationProcessing form data without nonce verification.130
Category
Security
Occurrences
130
Severity
warning

Sample message

Processing form data without nonce verification.

ERRORSecurityOutput is not escapedAll output should be run through an escaping function (see the Security sections in the WordPress Developer Handbooks), found '"<div class='upk-option-item {$class} {$widget_used_status}' {$data_type}>"'.109
Category
Security
Occurrences
109
Severity
error

Sample message

All output should be run through an escaping function (see the Security sections in the WordPress Developer Handbooks), found '"<div class='upk-option-item {$class} {$widget_used_status}' {$data_type}>"'.

WARNINGSecurityRequest data is not unslashed$_GET[&#039;duplicate_nonce&#039;] not unslashed before sanitization. Use wp_unslash() or similar56
Category
Security
Occurrences
56
Severity
warning

Sample message

$_GET[&#039;duplicate_nonce&#039;] not unslashed before sanitization. Use wp_unslash() or similar

WARNINGPerformancePost Not In excludeUsing exclusionary parameters, like exclude, in calls to get_posts() should be done with caution, see https://wpvip.com/documentation/performance-improvements-by-removing-usage-of-post__not_in/ for more information.56
Category
Performance
Occurrences
56
Severity
warning

Sample message

Using exclusionary parameters, like exclude, in calls to get_posts() should be done with caution, see https://wpvip.com/documentation/performance-improvements-by-removing-usage-of-post__not_in/ for more information.

WARNINGMaintainabilityNon-prefixed global variableGlobal variables defined by a theme/plugin should start with the theme/plugin prefix. Found: &quot;$active_modules&quot;.46
Category
Maintainability
Occurrences
46
Severity
warning

Sample message

Global variables defined by a theme/plugin should start with the theme/plugin prefix. Found: &quot;$active_modules&quot;.

WARNINGSecurityInput is not sanitizedDetected usage of a non-sanitized input variable: $_GET[&#039;duplicate_nonce&#039;]26
Category
Security
Occurrences
26
Severity
warning

Sample message

Detected usage of a non-sanitized input variable: $_GET[&#039;duplicate_nonce&#039;]

WARNINGSecurityNonce verification recommendedProcessing form data without nonce verification.24
Category
Security
Occurrences
24
Severity
warning

Sample message

Processing form data without nonce verification.

ERRORI18nMissing Translators CommentA function call to __() with texts containing placeholders was found, but was not accompanied by a "translators:" comment on the line above to clarify the meaning of the placeholders.23
Category
I18n
Occurrences
23
Severity
error

Sample message

A function call to __() with texts containing placeholders was found, but was not accompanied by a "translators:" comment on the line above to clarify the meaning of the placeholders.

WARNINGMaintainabilityNon-prefixed functionFunctions declared in the global namespace by a theme/plugin should start with the theme/plugin prefix. Found: &quot;_is_elementor_installed&quot;.16
Category
Maintainability
Occurrences
16
Severity
warning

Sample message

Functions declared in the global namespace by a theme/plugin should start with the theme/plugin prefix. Found: &quot;_is_elementor_installed&quot;.

WARNINGMaintainabilityNon-prefixed hook nameHook names invoked by a theme/plugin should start with the theme/plugin prefix. Found: &quot;bdthemes_ultimate_post_kit/init&quot;.14
Category
Maintainability
Occurrences
14
Severity
warning

Sample message

Hook names invoked by a theme/plugin should start with the theme/plugin prefix. Found: &quot;bdthemes_ultimate_post_kit/init&quot;.

Show 15 more
ERRORI18nUnordered Placeholders Text13
Category
I18n
Occurrences
13
Severity
error

Sample message

Multiple placeholders in translatable strings should be ordered. Expected "%1$1s, %2$2s", but got "%1s, %2s" in 'This feature will not work in the Firefox browser untill you enable browser compatibility so please %1s look here %2s'.

WARNINGSecurityInput is not validated11
Category
Security
Occurrences
11
Severity
warning

Sample message

Detected usage of a possibly undefined superglobal array index: $_POST[&#039;email&#039;]. Check that the array index exists before using it.

ERRORSupply ChainCompressed files included8
Category
Supply Chain
Occurrences
8
Severity
error

Sample message

Compressed files are not permitted.

ERRORMaintainabilityMissing direct file access protection8
Category
Maintainability
Occurrences
8
Severity
error

Sample message

PHP file should prevent direct access. Add a check like: if ( ! defined( 'ABSPATH' ) ) exit;

WARNINGMaintainabilityprevent path disclosure error reporting6
Category
Maintainability
Occurrences
6
Severity
warning

Sample message

error_reporting() can lead to full path disclosure.

WARNINGPerformancePost Not In post not in6
Category
Performance
Occurrences
6
Severity
warning

Sample message

Using exclusionary parameters, like post__not_in, in calls to get_posts() should be done with caution, see https://wpvip.com/documentation/performance-improvements-by-removing-usage-of-post__not_in/ for more information.

ERRORI18nNon Singular String Literal Domain5
Category
I18n
Occurrences
5
Severity
error

Sample message

The $domain parameter must be a single text string literal. Found: $this->settings['text_domain']

WARNINGSecuritywp redirect wp redirect4
Category
Security
Occurrences
4
Severity
warning

Sample message

wp_redirect() found. Using wp_safe_redirect(), along with the &quot;allowed_redirect_hosts&quot; filter if needed, can help avoid any chances of malicious redirects within code. It is also important to remember to call exit() after a redirect so that no other unwanted code is executed.

ERRORMaintainabilityNo Explicit Version3
Category
Maintainability
Occurrences
3
Severity
error

Sample message

Version parameter is not explicitly set or has been set to an equivalent of "false" for wp_register_script; This means that the WordPress core version will be used which is not recommended for plugin or theme development.

WARNINGMaintainabilityNot In Footer3
Category
Maintainability
Occurrences
3
Severity
warning

Sample message

In footer ($in_footer) is not set explicitly wp_enqueue_script; It is recommended to load scripts in the footer. Please set this value to `true` to load it in the footer, or explicitly `false` if it should be loaded in the header.

ERRORSecurityDatabase parameter is not escaped2
Category
Security
Occurrences
2
Severity
error

Sample message

Unescaped parameter $bdt_post_id used in $wpdb->get_results()\n$bdt_post_id used without escaping.

WARNINGMaintainabilityDirect Query2
Category
Maintainability
Occurrences
2
Severity
warning

Sample message

Use of a direct database call is discouraged.

WARNINGMaintainabilityNo Caching2
Category
Maintainability
Occurrences
2
Severity
warning

Sample message

Direct database call without caching detected. Consider using wp_cache_get() / wp_cache_set() or wp_cache_delete().

WARNINGMaintainabilityslow db query tax query2
Category
Maintainability
Occurrences
2
Severity
warning

Sample message

Detected usage of tax_query, possible slow query.

ERRORMaintainabilityparse url parse url2
Category
Maintainability
Occurrences
2
Severity
error

Sample message

parse_url() is discouraged because of inconsistency in the output across PHP versions; use wp_parse_url() instead.

External Connections

Potential connections found in static code analysis.

57 domains

Outbound calls

291

External assets

1

Incoming endpoints

8

Notable Domains

youtu.be87 · outbound
bdthemes.com10 · outbound
connect.ok.ru4 · outbound
vk.com4 · outbound
youtube.com4 · outbound
facebook.com3 · outbound

Platform / Reference Domains

w3.org3 · platform/reference
github.com1 · platform/reference
wordpress.org1 · platform/reference

External Asset Domains

postkit.pro102 · asset + outbound

Incoming Endpoints

No public endpoints detected.

Admin AJAX endpoints8
wp_ajax_ultimate_post_kit_settings_saveauthenticated

wp_ajax

wp_ajax_ultimate-post-kit-biggoptiesauthenticated

wp_ajax

wp_ajax_upk_admin_api_biggopti_dismissauthenticated

wp_ajax

wp_ajax_upk_fetch_api_biggoptiesauthenticated

wp_ajax

wp_ajax_upk_install_pluginauthenticated

wp_ajax

wp_ajax_upk_revoke_white_label_tokenauthenticated

wp_ajax

wp_ajax_upk_save_custom_codeauthenticated

wp_ajax

wp_ajax_upk_save_white_labelauthenticated

wp_ajax

Score History

3 score snapshots

+0
1007550250Jun 20, 2026, 03:10 AM UTC Score 25/100 Plugin v4.1.13 Plugin Check 2.0.0 182 errors, 412 warningsJun 21, 2026, 10:35 AM UTC Score 25/100 Plugin v4.1.14 Plugin Check 2.0.0 182 errors, 412 warningsJun 23, 2026, 11:35 AM UTC Score 25/100 Plugin v4.1.15 Plugin Check 2.0.0 182 errors, 412 warningsJun 20, 2026Jun 23, 2026

v4.1.15

25

Latest

Findings
594
Errors
182
Warnings
412
Check
2.0.0

v4.1.14

25

Score

Findings
594
Errors
182
Warnings
412
Check
2.0.0

Relationship Map

Author, categories, issues, domains, and nearby plugins.

37 nodes

Related Plugins