Orders Tracking for WooCommerce

Easily import/manage your tracking numbers, add tracking numbers to PayPal and send email notifications to customers.

v1.3.0VillaThemeUpdated Added 10k+ installs90% rating0% support resolved
37
Score
7
Errors
312
Warnings
+1
Change

Category Scores

Security0
Repo100
Performance100
Maintainability59

Issues to Review

Prioritized issue groups from the latest Plugin Check scan

319 findings

Security

202

5 issue groups

Maintainability

114

13 issue groups

I18n

3

3 issue groups

WARNINGSecurityRequest data is not unslashed$_GET['_vi_wot_setting_nonce'] not unslashed before sanitization. Use wp_unslash() or similar115
Category
Security
Occurrences
115
Severity
warning

Sample message

$_GET['_vi_wot_setting_nonce'] not unslashed before sanitization. Use wp_unslash() or similar

WARNINGSecurityInput is not sanitizedDetected usage of a non-sanitized input variable: $_GET['_vi_wot_setting_nonce']54
Category
Security
Occurrences
54
Severity
warning

Sample message

Detected usage of a non-sanitized input variable: $_GET['_vi_wot_setting_nonce']

WARNINGSecurityDatabase parameter is not escapedUnescaped parameter $query used in $wpdb->get_results()\n$query assigned unsafely at line 1354.29
Category
Security
Occurrences
29
Severity
warning

Sample message

Unescaped parameter $query used in $wpdb->get_results()\n$query assigned unsafely at line 1354.

WARNINGMaintainabilityNon-prefixed classClasses declared by a theme/plugin should start with the theme/plugin prefix. Found: "VIWOT_WOO_ORDERS_TRACKING".27
Category
Maintainability
Occurrences
27
Severity
warning

Sample message

Classes declared by a theme/plugin should start with the theme/plugin prefix. Found: "VIWOT_WOO_ORDERS_TRACKING".

WARNINGMaintainabilityNon-prefixed hook nameHook names invoked by a theme/plugin should start with the theme/plugin prefix. Found: "plugin_locale".27
Category
Maintainability
Occurrences
27
Severity
warning

Sample message

Hook names invoked by a theme/plugin should start with the theme/plugin prefix. Found: "plugin_locale".

WARNINGMaintainabilityNon-prefixed global variableGlobal variables defined by a theme/plugin should start with the theme/plugin prefix. Found: "$date_format".26
Category
Maintainability
Occurrences
26
Severity
warning

Sample message

Global variables defined by a theme/plugin should start with the theme/plugin prefix. Found: "$date_format".

WARNINGMaintainabilityNon-prefixed constantGlobal constants defined by a theme/plugin should start with the theme/plugin prefix. Found: "VI_WOO_ORDERS_TRACKING_ADMIN".18
Category
Maintainability
Occurrences
18
Severity
warning

Sample message

Global constants defined by a theme/plugin should start with the theme/plugin prefix. Found: "VI_WOO_ORDERS_TRACKING_ADMIN".

WARNINGMaintainabilityNon-prefixed functionFunctions declared in the global namespace by a theme/plugin should start with the theme/plugin prefix. Found: "vi_include_folder".4
Category
Maintainability
Occurrences
4
Severity
warning

Sample message

Functions declared in the global namespace by a theme/plugin should start with the theme/plugin prefix. Found: "vi_include_folder".

WARNINGMaintainabilityerror log var exportvar_export() found. Debug code should not normally be used in production.4
Category
Maintainability
Occurrences
4
Severity
warning

Sample message

var_export() found. Debug code should not normally be used in production.

WARNINGSecurityMissing nonce verificationProcessing form data without nonce verification.2
Category
Security
Occurrences
2
Severity
warning

Sample message

Processing form data without nonce verification.

Show 11 more
WARNINGSecurityNonce verification recommended2
Category
Security
Occurrences
2
Severity
warning

Sample message

Processing form data without nonce verification.

ERRORMaintainabilitywp function not compatible with requires wp2
Category
Maintainability
Occurrences
2
Severity
error

Sample message

Function "is_php_version_compatible()" requires WordPress 5.2.0, but your plugin minimum supported version is WordPress 5.0.0.

WARNINGI18nDiscouraged text-domain loading1
Category
I18n
Occurrences
1
Severity
warning

Sample message

load_plugin_textdomain() has been discouraged since WordPress version 4.6. When your plugin is hosted on WordPress.org, you no longer need to manually include this function call for translations under your plugin slug. WordPress will automatically load the translations for you as needed.

ERRORMaintainabilityOffloaded Content1
Category
Maintainability
Occurrences
1
Severity
error

Sample message

Found call to wp_enqueue_style() with external resource. Offloading styles to your servers or any remote service is disallowed.

WARNINGMaintainabilityShort URL found1
Category
Maintainability
Occurrences
1
Severity
warning

Sample message

Short URL detected (bit.ly). Use full URLs instead of URL shorteners.

WARNINGMaintainabilityDiscouraged PHP function1
Category
Maintainability
Occurrences
1
Severity
warning

Sample message

The use of function set_time_limit() is discouraged

ERRORMaintainabilitydate date1
Category
Maintainability
Occurrences
1
Severity
error

Sample message

date() is affected by runtime timezone changes which can cause date/time to be incorrectly displayed. Use gmdate() instead.

ERRORI18nMissing Translators Comment1
Category
I18n
Occurrences
1
Severity
error

Sample message

A function call to __() with texts containing placeholders was found, but was not accompanied by a "translators:" comment on the line above to clarify the meaning of the placeholders.

ERRORI18nUnordered Placeholders Text1
Category
I18n
Occurrences
1
Severity
error

Sample message

Multiple placeholders in translatable strings should be ordered. Expected "%1$s, %2$s", but got "%s, %s" in 'Please enter your %s api key. If you don\'t have an account, <a href="%s" target="_blank"><strong>click here</strong></a> to create one and generate api key'.

WARNINGMaintainabilitytrademarked term1
Category
Maintainability
Occurrences
1
Severity
warning

Sample message

The plugin slug includes a restricted term. Your plugin slug - "woo-orders-tracking" - contains the restricted term "woo" and cannot be used to begin your plugin slug. We disallow the use of certain terms in ways that are abused, or potentially infringe on and/or are misleading with regards to trademarks. You may use the term "woo" elsewhere in your plugin slug, such as "... for woo".

ERRORMaintainabilitytrunk stable tag1
Category
Maintainability
Occurrences
1
Severity
error

Sample message

Incorrect Stable Tag. It's recommended not to use "Stable Tag: trunk". Your Stable Tag is meant to be the stable version of your plugin and it needs to be exactly the same with the Version in your main plugin file's header. Any mismatch can prevent users from downloading the correct plugin files from WordPress.org.

External Connections

Potential connections found in static code analysis.

100 domains

Outbound calls

217

External assets

2

Incoming endpoints

15

Notable Domains

1.envato.market23 · outbound
wwwapps.ups.com5 · outbound
dhl.com4 · outbound
logistics.dhl4 · outbound
tnt.com4 · outbound
tracking.dpd.de4 · outbound

Platform / Reference Domains

github.com31 · platform/reference
opensource.org26 · platform/reference
wordpress.org2 · platform/reference
api.wordpress.org1 · platform/reference
gnu.org1 · platform/reference

External Asset Domains

Incoming Endpoints

No public endpoints detected.

Admin AJAX endpoints15
wp_ajax_vi_woo_orders_tracking_add_tracking_to_paypalauthenticated

wp_ajax

wp_ajax_vi_wot_customize_params_date_time_formatauthenticated

wp_ajax

wp_ajax_vi_wot_export_previewauthenticated

wp_ajax

wp_ajax_vi_wot_refresh_track_infoauthenticated

wp_ajax

wp_ajax_vi_wot_save_filter_settingsauthenticated

wp_ajax

wp_ajax_vi_wot_view_logauthenticated

wp_ajax

wp_ajax_woo_orders_tracking_importauthenticated

wp_ajax

wp_ajax_woo_orders_tracking_search_pageauthenticated

wp_ajax

wp_ajax_wot_preview_emailsauthenticated

wp_ajax

wp_ajax_wot_test_connection_paypalauthenticated

wp_ajax

wp_ajax_wotv_admin_add_new_shipping_carrierauthenticated

wp_ajax

wp_ajax_wotv_admin_delete_shipping_carrierauthenticated

wp_ajax

3 more hidden

Score History

2 score snapshots

+1
1007550250Jun 20, 2026, 01:19 PM UTC Score 36/100 Plugin v1.2.17 Plugin Check 2.0.0 8 errors, 330 warningsJun 26, 2026, 10:58 AM UTC Score 37/100 Plugin v1.3.0 Plugin Check 2.0.0 7 errors, 312 warningsJun 20, 2026Jun 26, 2026

v1.3.0

37

Latest

Findings
319
Errors
7
Warnings
312
Check
2.0.0

v1.2.17

36

Score

Findings
338
Errors
8
Warnings
330
Check
2.0.0

Relationship Map

Author, categories, issues, domains, and nearby plugins.

37 nodes

Related Plugins