The original WooCommerce multi-vendor plugin. Easily create a WooCommerce marketplace with multi-seller, product vendor stores & vendor commissions.
24
Score
169
Errors
599
Warnings
+0
Change
Category Scores
Security0
Repo90
Performance100
Maintainability0
Issues to Review
Prioritized issue groups from the latest Plugin Check scan
Maintainability
677
19 issue groups
Security
85
6 issue groups
WARNINGMaintainabilityNon-prefixed classClasses declared by a theme/plugin should start with the theme/plugin prefix. Found: "APICredentialsType".515
- Category
- Maintainability
- Occurrences
- 515
- Severity
- warning
Sample message
Classes declared by a theme/plugin should start with the theme/plugin prefix. Found: "APICredentialsType".
ERRORMaintainabilityMissing direct file access protectionPHP file should prevent direct access. Add a check like: if ( ! defined( 'ABSPATH' ) ) exit;98
- Category
- Maintainability
- Occurrences
- 98
- Severity
- error
Sample message
PHP file should prevent direct access. Add a check like: if ( ! defined( 'ABSPATH' ) ) exit;
ERRORSecurityException output is not escapedAll output should be run through an escaping function (see the Security sections in the WordPress Developer Handbooks), found '"Config file $fileName not found"'.26
- Category
- Security
- Occurrences
- 26
- Severity
- error
Sample message
All output should be run through an escaping function (see the Security sections in the WordPress Developer Handbooks), found '"Config file $fileName not found"'.
WARNINGSecurityInput is not sanitizedDetected usage of a non-sanitized input variable: $_ENV['CONTENT_TYPE']16
- Category
- Security
- Occurrences
- 16
- Severity
- warning
Sample message
Detected usage of a non-sanitized input variable: $_ENV['CONTENT_TYPE']
WARNINGSecurityRequest data is not unslashed$_SERVER['CONTENT_TYPE'] not unslashed before sanitization. Use wp_unslash() or similar14
- Category
- Security
- Occurrences
- 14
- Severity
- warning
Sample message
$_SERVER['CONTENT_TYPE'] not unslashed before sanitization. Use wp_unslash() or similar
WARNINGSecurityDatabase parameter is not escapedUnescaped parameter $id_column used in $wpdb->get_col()\n$id_column assigned unsafely at line 797.12
- Category
- Security
- Occurrences
- 12
- Severity
- warning
Sample message
Unescaped parameter $id_column used in $wpdb->get_col()\n$id_column assigned unsafely at line 797.
WARNINGMaintainabilityNon-prefixed constantGlobal constants defined by a theme/plugin should start with the theme/plugin prefix. Found: "WCV_ABSPATH_ADMIN".11
- Category
- Maintainability
- Occurrences
- 11
- Severity
- warning
Sample message
Global constants defined by a theme/plugin should start with the theme/plugin prefix. Found: "WCV_ABSPATH_ADMIN".
WARNINGSecurityInput is not validatedDetected usage of a possibly undefined superglobal array index: $_REQUEST['from_date']. Check that the array index exists before using it.11
- Category
- Security
- Occurrences
- 11
- Severity
- warning
Sample message
Detected usage of a possibly undefined superglobal array index: $_REQUEST['from_date']. Check that the array index exists before using it.
ERRORSecurityUnsupported Identifier PlaceholderThe %i modifier is only supported in WP 6.2 or higher. Found: "%i".6
- Category
- Security
- Occurrences
- 6
- Severity
- error
Sample message
The %i modifier is only supported in WP 6.2 or higher. Found: "%i".
WARNINGMaintainabilityNon-prefixed global variableGlobal variables defined by a theme/plugin should start with the theme/plugin prefix. Found: "$disconnect_url".6
- Category
- Maintainability
- Occurrences
- 6
- Severity
- warning
Sample message
Global variables defined by a theme/plugin should start with the theme/plugin prefix. Found: "$disconnect_url".
Show 15 moreShow less
ERRORMaintainabilitycurl curl errno6
- Category
- Maintainability
- Occurrences
- 6
- Severity
- error
Sample message
Using cURL functions is highly discouraged. Use wp_remote_get() instead.
ERRORMaintainabilitycurl curl exec6
- Category
- Maintainability
- Occurrences
- 6
- Severity
- error
Sample message
Using cURL functions is highly discouraged. Use wp_remote_get() instead.
ERRORMaintainabilityparse url parse url6
- Category
- Maintainability
- Occurrences
- 6
- Severity
- error
Sample message
parse_url() is discouraged because of inconsistency in the output across PHP versions; use wp_parse_url() instead.
ERRORMaintainabilitycurl curl close4
- Category
- Maintainability
- Occurrences
- 4
- Severity
- error
Sample message
Using cURL functions is highly discouraged. Use wp_remote_get() instead.
ERRORMaintainabilitycurl curl getinfo4
- Category
- Maintainability
- Occurrences
- 4
- Severity
- error
Sample message
Using cURL functions is highly discouraged. Use wp_remote_get() instead.
WARNINGMaintainabilitytrademarked term3
- Category
- Maintainability
- Occurrences
- 3
- Severity
- warning
Sample message
The plugin name includes a restricted term. Your chosen plugin name - "WC Vendors - WooCommerce Multivendor, WooCommerce Marketplace, Product Vendors" - contains the restricted term "woocommerce" which cannot be used within in your plugin name, unless your plugin name contains one of the allowed patterns: "for woocommerce", "with woocommerce", "using woocommerce", or "and woocommerce". The term must still not appear anywhere else in your name.
WARNINGMaintainabilityDirect Query2
- Category
- Maintainability
- Occurrences
- 2
- Severity
- warning
Sample message
Use of a direct database call is discouraged.
WARNINGMaintainabilityNo Caching2
- Category
- Maintainability
- Occurrences
- 2
- Severity
- warning
Sample message
Direct database call without caching detected. Consider using wp_cache_get() / wp_cache_set() or wp_cache_delete().
WARNINGMaintainabilityerror log error log2
- Category
- Maintainability
- Occurrences
- 2
- Severity
- warning
Sample message
error_log() found. Debug code should not normally be used in production.
WARNINGMaintainabilityerror log trigger error2
- Category
- Maintainability
- Occurrences
- 2
- Severity
- warning
Sample message
trigger_error() found. Debug code should not normally be used in production.
ERRORMaintainabilitycurl curl error2
- Category
- Maintainability
- Occurrences
- 2
- Severity
- error
Sample message
Using cURL functions is highly discouraged. Use wp_remote_get() instead.
ERRORMaintainabilitycurl curl init2
- Category
- Maintainability
- Occurrences
- 2
- Severity
- error
Sample message
Using cURL functions is highly discouraged. Use wp_remote_get() instead.
ERRORMaintainabilitycurl curl setopt2
- Category
- Maintainability
- Occurrences
- 2
- Severity
- error
Sample message
Using cURL functions is highly discouraged. Use wp_remote_get() instead.
ERRORMaintainabilitycurl curl setopt array2
- Category
- Maintainability
- Occurrences
- 2
- Severity
- error
Sample message
Using cURL functions is highly discouraged. Use wp_remote_get() instead.
ERRORMaintainabilityrand mt rand2
- Category
- Maintainability
- Occurrences
- 2
- Severity
- error
Sample message
mt_rand() is discouraged. Use the far less predictable wp_rand() instead.
External Connections
Potential connections found in static code analysis.
Outbound calls
280
External assets
2
Incoming endpoints
18
Notable Domains
wcvendors.com60 · outbound
tracking.dpd.de7 · outbound
en.wikipedia.org5 · outbound
mgates.me5 · outbound
wwwapps.ups.com4 · outbound
developer.mozilla.org3 · outbound
Platform / Reference Domains
w3.org58 · platform/reference
github.com29 · platform/reference
wordpress.org9 · platform/reference
opensource.org2 · platform/reference
gnu.org1 · platform/reference
ps.w.org1 · platform/reference
External Asset Domains
fonts.googleapis.com2 · asset + outbound
cdnjs.cloudflare.com1 · asset
Incoming Endpoints
No public endpoints detected.
Admin AJAX endpoints18
wp_ajax_wcv_check_store_agent_statusauthenticated
wp_ajax
wp_ajax_wcv_dismiss_store_setup_step_sectionauthenticated
wp_ajax
wp_ajax_wcv_install_activate_pluginauthenticated
wp_ajax
wp_ajax_wcv_json_add_attributeauthenticated
wp_ajax
wp_ajax_wcv_json_add_new_attributeauthenticated
wp_ajax
wp_ajax_wcv_json_add_variationauthenticated
wp_ajax
wp_ajax_wcv_json_default_variation_attributesauthenticated
wp_ajax
wp_ajax_wcv_json_link_all_variationsauthenticated
wp_ajax
wp_ajax_wcv_json_load_variationauthenticated
wp_ajax
wp_ajax_wcv_json_search_productsauthenticated
wp_ajax
wp_ajax_wcv_json_search_tagsauthenticated
wp_ajax
wp_ajax_wcv_json_unique_store_nameauthenticated
wp_ajax
6 more hidden
Score History
5 score snapshots
v2.7.2.2
24
Latest
- Findings
- 768
- Errors
- 169
- Warnings
- 599
- Check
- 2.1.0
v2.7.2.1
24
Score
- Findings
- 761
- Errors
- 169
- Warnings
- 592
- Check
- 2.1.0
| Scan | Score | Findings | Errors | Warnings | Plugin | Check |
|---|---|---|---|---|---|---|
| Latest | 24 | 768 | 169 | 599 | v2.7.2.2 | 2.1.0 |
| 24 | 761 | 169 | 592 | v2.7.2.1 | 2.1.0 |
Relationship Map
Author, categories, issues, domains, and nearby plugins.
Loading map
PluginAuthorCategoryIssueDomainRelated
Relationship links
Author
Category
Issue
Non-prefixed class515 findingsMissing direct file access protection98 findingsException output is not escaped26 findingsInput is not sanitized16 findingsRequest data is not unslashed14 findingsDatabase parameter is not escaped12 findingsNon-prefixed constant11 findingsInput is not validated11 findings
Domain
Related
Meks ThemeForest Smart Widget79 scoreElementor Website Builder – more than just a page builder39 scoreYoast SEO – Advanced SEO with real-time guidance and built-in AI24 scoreWooCommerce22 scoreContact Form 769 scoreLiteSpeed Cache35 scoreWordfence Security – Firewall, Malware Scan, and Login Security21 scoreAkismet Anti-spam: Spam Protection35 scoreWPCode – Insert Headers and Footers + Custom Code Snippets – WordPress Code Manager88 scoreJetpack – WP Security, Backup, Speed, & Growth22 scoreDokan: AI Powered WooCommerce Multivendor Marketplace Solution – Build Your Own Amazon, eBay, Etsy23 scoreWCFM – Frontend Manager for WooCommerce21 scoreWCFM Marketplace – Multivendor Marketplace for WooCommerce21 scoreWCFM Membership – WooCommerce Memberships for Multivendor Marketplace22 score
Author
Category
Issue
Non-prefixed class515 findingsMissing direct file access protection98 findingsException output is not escaped26 findingsInput is not sanitized16 findingsRequest data is not unslashed14 findingsDatabase parameter is not escaped12 findingsNon-prefixed constant11 findingsInput is not validated11 findings
Domain
Related
Meks ThemeForest Smart Widget79 scoreElementor Website Builder – more than just a page builder39 scoreYoast SEO – Advanced SEO with real-time guidance and built-in AI24 scoreWooCommerce22 scoreContact Form 769 scoreLiteSpeed Cache35 scoreWordfence Security – Firewall, Malware Scan, and Login Security21 scoreAkismet Anti-spam: Spam Protection35 scoreWPCode – Insert Headers and Footers + Custom Code Snippets – WordPress Code Manager88 scoreJetpack – WP Security, Backup, Speed, & Growth22 scoreDokan: AI Powered WooCommerce Multivendor Marketplace Solution – Build Your Own Amazon, eBay, Etsy23 scoreWCFM – Frontend Manager for WooCommerce21 scoreWCFM Marketplace – Multivendor Marketplace for WooCommerce21 scoreWCFM Membership – WooCommerce Memberships for Multivendor Marketplace22 score
Related Plugins
Dokan Menu Hider
500 active installs
95
Meks ThemeForest Smart Widget
10k+ active installs
79
Faire for WooCommerce
800 active installs
68
XML Feed for Skroutz & BestPrice for WooCommerce
600 active installs
57
WCFM – WCFM Marketplace integrate Elementor
1k+ active installs
44
Dokan Invoice
500 active installs
35