Professional frontend dashboard for WooCommerce and multivendor marketplaces. Supports WCFM Marketplace, Dokan, WC Vendors, WC Product Vendors.
22
Score
4,731
Errors
5,057
Warnings
+0
Change
Category Scores
Security0
Repo88
Performance85
Maintainability0
Issues to Review
Prioritized issue groups from the latest Plugin Check scan
Security
4,531
10 issue groups
Maintainability
3,608
10 issue groups
I18n
1,482
5 issue groups
WARNINGMaintainabilityNon-prefixed global variableGlobal variables defined by a theme/plugin should start with the theme/plugin prefix. Found: "$Dokan_Moip_Withdraw".2,608
- Category
- Maintainability
- Occurrences
- 2,608
- Severity
- warning
Sample message
Global variables defined by a theme/plugin should start with the theme/plugin prefix. Found: "$Dokan_Moip_Withdraw".
ERRORSecurityOutput is not escapedAll output should be run through an escaping function (see the Security sections in the WordPress Developer Handbooks), found '$article_taxonomy'.1,381
- Category
- Security
- Occurrences
- 1,381
- Severity
- error
Sample message
All output should be run through an escaping function (see the Security sections in the WordPress Developer Handbooks), found '$article_taxonomy'.
ERRORSecurityUnsafe printing functionAll output should be run through an escaping function (like esc_html_e() or esc_attr_e()), found '_e'.1,199
- Category
- Security
- Occurrences
- 1,199
- Severity
- error
Sample message
All output should be run through an escaping function (like esc_html_e() or esc_attr_e()), found '_e'.
ERRORI18nText Domain MismatchMismatched text domain. Expected 'wc-frontend-manager' but got ''.1,037
- Category
- I18n
- Occurrences
- 1,037
- Severity
- error
Sample message
Mismatched text domain. Expected 'wc-frontend-manager' but got ''.
WARNINGSecurityMissing nonce verificationProcessing form data without nonce verification.706
- Category
- Security
- Occurrences
- 706
- Severity
- warning
Sample message
Processing form data without nonce verification.
ERRORSecuritySQL query is not preparedUse placeholders and $wpdb->prepare(); found $balance_sql289
- Category
- Security
- Occurrences
- 289
- Severity
- error
Sample message
Use placeholders and $wpdb->prepare(); found $balance_sql
WARNINGSecurityRequest data is not unslashed$_GET[$var] not unslashed before sanitization. Use wp_unslash() or similar280
- Category
- Security
- Occurrences
- 280
- Severity
- warning
Sample message
$_GET[$var] not unslashed before sanitization. Use wp_unslash() or similar
ERRORI18nMissing Translators CommentA function call to __() with texts containing placeholders was found, but was not accompanied by a "translators:" comment on the line above to clarify the meaning of the placeholders.254
- Category
- I18n
- Occurrences
- 254
- Severity
- error
Sample message
A function call to __() with texts containing placeholders was found, but was not accompanied by a "translators:" comment on the line above to clarify the meaning of the placeholders.
WARNINGMaintainabilityNon-prefixed hook nameHook names invoked by a theme/plugin should start with the theme/plugin prefix. Found: "'afet_field_wrapper_' . $field['id']".239
- Category
- Maintainability
- Occurrences
- 239
- Severity
- warning
Sample message
Hook names invoked by a theme/plugin should start with the theme/plugin prefix. Found: "'afet_field_wrapper_' . $field['id']".
WARNINGSecurityInput is not sanitizedDetected usage of a non-sanitized input variable: $_GET[$var]230
- Category
- Security
- Occurrences
- 230
- Severity
- warning
Sample message
Detected usage of a non-sanitized input variable: $_GET[$var]
Show 15 moreShow less
WARNINGMaintainabilityDirect Query225
- Category
- Maintainability
- Occurrences
- 225
- Severity
- warning
Sample message
Use of a direct database call is discouraged.
WARNINGMaintainabilityNo Caching220
- Category
- Maintainability
- Occurrences
- 220
- Severity
- warning
Sample message
Direct database call without caching detected. Consider using wp_cache_get() / wp_cache_set() or wp_cache_delete().
WARNINGSecurityNonce verification recommended156
- Category
- Security
- Occurrences
- 156
- Severity
- warning
Sample message
Processing form data without nonce verification.
WARNINGSecurityInput is not validated155
- Category
- Security
- Occurrences
- 155
- Severity
- warning
Sample message
Detected usage of a possibly undefined superglobal array index: $_GET['term']. Check that the array index exists before using it.
ERRORI18nNon Singular String Literal Text116
- Category
- I18n
- Occurrences
- 116
- Severity
- error
Sample message
The $text parameter must be a single text string literal. Found: $article_taxonomy->label
ERRORSecurityDatabase parameter is not escaped107
- Category
- Security
- Occurrences
- 107
- Severity
- error
Sample message
Unescaped parameter $create_table_query used in $wpdb->query()\n$create_table_query used without escaping.
ERRORMaintainabilitydate date96
- Category
- Maintainability
- Occurrences
- 96
- Severity
- error
Sample message
date() is affected by runtime timezone changes which can cause date/time to be incorrectly displayed. Use gmdate() instead.
ERRORMaintainabilityMissing direct file access protection85
- Category
- Maintainability
- Occurrences
- 85
- Severity
- error
Sample message
PHP file should prevent direct access. Add a check like: if ( ! defined( 'ABSPATH' ) ) exit;
ERRORI18nMissing Arg Domain47
- Category
- I18n
- Occurrences
- 47
- Severity
- error
Sample message
Missing $domain parameter in function call to __().
WARNINGMaintainabilityslow db query meta key40
- Category
- Maintainability
- Occurrences
- 40
- Severity
- warning
Sample message
Detected usage of meta_key, possible slow query.
WARNINGMaintainabilityslow db query meta value37
- Category
- Maintainability
- Occurrences
- 37
- Severity
- warning
Sample message
Detected usage of meta_value, possible slow query.
ERRORMaintainabilityDeprecated parameter: get_terms parameter 230
- Category
- Maintainability
- Occurrences
- 30
- Severity
- error
Sample message
The parameter "$args" at position #2 of get_terms() has been deprecated since WordPress version 4.5.0. Instead do not pass the parameter.
WARNINGSecurityInterpolated SQL is not prepared28
- Category
- Security
- Occurrences
- 28
- Severity
- warning
Sample message
Use placeholders and $wpdb->prepare(); found interpolated variable {$current_user_id} at \tAND posts.post_author = {$current_user_id}\n
ERRORMaintainabilitystrip tags strip tags28
- Category
- Maintainability
- Occurrences
- 28
- Severity
- error
Sample message
strip_tags() is discouraged. Use the more comprehensive wp_strip_all_tags() instead.
WARNINGI18nNo Html Wrapped Strings28
- Category
- I18n
- Occurrences
- 28
- Severity
- warning
Sample message
Translatable string should not be wrapped in HTML. Found: '<h2>\n Notice something missing in your marketplace?\n </h2>'
External Connections
Potential connections found in static code analysis.
Outbound calls
238
External assets
8
Incoming endpoints
54
Notable Domains
fontawesome.com22 · outbound
en.wikipedia.org14 · outbound
fontawesome.io4 · outbound
developers.google.com3 · outbound
fly-phone.com3 · outbound
jacklmoore.com3 · outbound
Platform / Reference Domains
github.com12 · platform/reference
wordpress.org5 · platform/reference
downloads.wordpress.org1 · platform/reference
External Asset Domains
wclovers.com35 · asset + outbound
Incoming Endpoints
wp_ajax_nopriv_wcfm_ajax_controllerpublic
wp_ajax
wp_ajax_nopriv_wcfm_enquiry_form_contentpublic
wp_ajax
wp_ajax_nopriv_wcfm_login_popup_formpublic
wp_ajax
wp_ajax_nopriv_wcfm_login_popup_submitpublic
wp_ajax
wp_ajax_nopriv_wcfm_store_external_product_view_updatepublic
wp_ajax
Admin AJAX endpoints49
wp_ajax_approve_listingauthenticated
wp_ajax
wp_ajax_archive_wcfm_knowledgebaseauthenticated
wp_ajax
wp_ajax_archive_wcfm_noticeauthenticated
wp_ajax
wp_ajax_customer_details_change_urlauthenticated
wp_ajax
wp_ajax_delete_wcfm_articleauthenticated
wp_ajax
wp_ajax_delete_wcfm_customerauthenticated
wp_ajax
wp_ajax_delete_wcfm_enquiryauthenticated
wp_ajax
wp_ajax_delete_wcfm_enquiry_responseauthenticated
wp_ajax
wp_ajax_delete_wcfm_knowledgebaseauthenticated
wp_ajax
wp_ajax_delete_wcfm_noticeauthenticated
wp_ajax
wp_ajax_delete_wcfm_productauthenticated
wp_ajax
wp_ajax_publish_wcfm_knowledgebaseauthenticated
wp_ajax
37 more hidden
Score History
3 score snapshots
v6.8.0
22
Latest
- Findings
- 9,788
- Errors
- 4,731
- Warnings
- 5,057
- Check
- 2.0.0
v6.7.28
22
Score
- Findings
- 9,808
- Errors
- 4,754
- Warnings
- 5,054
- Check
- 2.0.0
| Scan | Score | Findings | Errors | Warnings | Plugin | Check |
|---|---|---|---|---|---|---|
| Latest | 22 | 9,788 | 4,731 | 5,057 | v6.8.0 | 2.0.0 |
| 22 | 9,808 | 4,754 | 5,054 | v6.7.28 | 2.0.0 |
Relationship Map
Author, categories, issues, domains, and nearby plugins.
Loading map
PluginAuthorCategoryIssueDomainRelated
Relationship links
Author
Category
Issue
Non-prefixed global variable2,608 findingsOutput is not escaped1,381 findingsUnsafe printing function1,199 findingsText Domain Mismatch1,037 findingsMissing nonce verification706 findingsSQL query is not prepared289 findingsRequest data is not unslashed280 findingsMissing Translators Comment254 findings
Domain
Related
Dokan: AI Powered WooCommerce Multivendor Marketplace Solution – Build Your Own Amazon, eBay, Etsy23 scoreWCFM Marketplace – Multivendor Marketplace for WooCommerce22 scoreWCFM Membership – WooCommerce Memberships for Multivendor Marketplace22 scoreWC Vendors – WooCommerce Multivendor, WooCommerce Marketplace, Product Vendors24 scoreMultiVendorX – WooCommerce Multivendor Marketplace AI Powered Solutions31 scoreTourfic – AI Powered Travel Booking, Hotel Booking & Car Rental WordPress Plugin25 scoreWCFM – WCFM Marketplace integrate Elementor44 scoreYoast SEO – Advanced SEO with real-time guidance and built-in AI24 scoreWooCommerce21 scoreAkismet Anti-spam: Spam Protection35 scoreContact Form 769 scoreElementor Website Builder – more than just a page builder39 scoreClassic Editor63 scoreLiteSpeed Cache35 score
Author
Category
Issue
Non-prefixed global variable2,608 findingsOutput is not escaped1,381 findingsUnsafe printing function1,199 findingsText Domain Mismatch1,037 findingsMissing nonce verification706 findingsSQL query is not prepared289 findingsRequest data is not unslashed280 findingsMissing Translators Comment254 findings
Domain
Related
Dokan: AI Powered WooCommerce Multivendor Marketplace Solution – Build Your Own Amazon, eBay, Etsy23 scoreWCFM Marketplace – Multivendor Marketplace for WooCommerce22 scoreWCFM Membership – WooCommerce Memberships for Multivendor Marketplace22 scoreWC Vendors – WooCommerce Multivendor, WooCommerce Marketplace, Product Vendors24 scoreMultiVendorX – WooCommerce Multivendor Marketplace AI Powered Solutions31 scoreTourfic – AI Powered Travel Booking, Hotel Booking & Car Rental WordPress Plugin25 scoreWCFM – WCFM Marketplace integrate Elementor44 scoreYoast SEO – Advanced SEO with real-time guidance and built-in AI24 scoreWooCommerce21 scoreAkismet Anti-spam: Spam Protection35 scoreContact Form 769 scoreElementor Website Builder – more than just a page builder39 scoreClassic Editor63 scoreLiteSpeed Cache35 score
Related Plugins
WCFM – WCFM Marketplace integrate Elementor
1k+ active installs
44
Dokan Invoice
500 active installs
35
MultiVendorX – WooCommerce Multivendor Marketplace AI Powered Solutions
2k+ active installs
31
25
24
