Easily add a range of custom fields to WooCommerce products, from text boxes to date selectors, allowing customers to personalize their orders.
21
Score
336
Errors
1,319
Warnings
+0
Change
Category Scores
Security0
Repo72
Performance100
Maintainability0
Issues to Review
Prioritized issue groups from the latest Plugin Check scan
Maintainability
1,121
14 issue groups
Security
516
9 issue groups
Supply Chain
2
1 issue group
I18n
1
1 issue group
WARNINGMaintainabilityNon-prefixed global variableGlobal variables defined by a theme/plugin should start with the theme/plugin prefix. Found: "$$multi_product_var".941
- Category
- Maintainability
- Occurrences
- 941
- Severity
- warning
Sample message
Global variables defined by a theme/plugin should start with the theme/plugin prefix. Found: "$$multi_product_var".
ERRORSecurityOutput is not escapedAll output should be run through an escaping function (see the Security sections in the WordPress Developer Handbooks), found '"<div class=\"updated\"><p>{$message}</p></div>"'.233
- Category
- Security
- Occurrences
- 233
- Severity
- error
Sample message
All output should be run through an escaping function (see the Security sections in the WordPress Developer Handbooks), found '"<div class=\"updated\"><p>{$message}</p></div>"'.
WARNINGMaintainabilityNon-prefixed hook nameHook names invoked by a theme/plugin should start with the theme/plugin prefix. Found: "'nm_input_class-' . $type".84
- Category
- Maintainability
- Occurrences
- 84
- Severity
- warning
Sample message
Hook names invoked by a theme/plugin should start with the theme/plugin prefix. Found: "'nm_input_class-' . $type".
WARNINGSecurityNonce verification recommendedProcessing form data without nonce verification.79
- Category
- Security
- Occurrences
- 79
- Severity
- warning
Sample message
Processing form data without nonce verification.
WARNINGSecurityRequest data is not unslashed$_GET[$data_name] not unslashed before sanitization. Use wp_unslash() or similar65
- Category
- Security
- Occurrences
- 65
- Severity
- warning
Sample message
$_GET[$data_name] not unslashed before sanitization. Use wp_unslash() or similar
ERRORSecurityUnsafe printing functionAll output should be run through an escaping function (like esc_html_e() or esc_attr_e()), found '_e'.46
- Category
- Security
- Occurrences
- 46
- Severity
- error
Sample message
All output should be run through an escaping function (like esc_html_e() or esc_attr_e()), found '_e'.
WARNINGSecurityInput is not sanitizedDetected usage of a non-sanitized input variable: $_FILES['file']['tmp_name']31
- Category
- Security
- Occurrences
- 31
- Severity
- warning
Sample message
Detected usage of a non-sanitized input variable: $_FILES['file']['tmp_name']
WARNINGMaintainabilityNon-prefixed classClasses declared by a theme/plugin should start with the theme/plugin prefix. Found: "NM_Audio_wooproduct".24
- Category
- Maintainability
- Occurrences
- 24
- Severity
- warning
Sample message
Classes declared by a theme/plugin should start with the theme/plugin prefix. Found: "NM_Audio_wooproduct".
WARNINGSecurityMissing nonce verificationProcessing form data without nonce verification.23
- Category
- Security
- Occurrences
- 23
- Severity
- warning
Sample message
Processing form data without nonce verification.
WARNINGSecurityDatabase parameter is not escapedUnescaped parameter $prepared used in $wpdb->get_results()\n$prepared assigned unsafely at line 83.17
- Category
- Security
- Occurrences
- 17
- Severity
- warning
Sample message
Unescaped parameter $prepared used in $wpdb->get_results()\n$prepared assigned unsafely at line 83.
Show 15 moreShow less
ERRORMaintainabilityMissing direct file access protection17
- Category
- Maintainability
- Occurrences
- 17
- Severity
- error
Sample message
PHP file should prevent direct access. Add a check like: if ( ! defined( 'ABSPATH' ) ) exit;
WARNINGSecurityInput is not validated16
- Category
- Security
- Occurrences
- 16
- Severity
- warning
Sample message
Detected usage of a possibly undefined superglobal array index: $_POST['ppom_product_id']. Check that the array index exists before using it.
WARNINGMaintainabilityMissing Version15
- Category
- Maintainability
- Occurrences
- 15
- Severity
- warning
Sample message
Resource version not set in call to wp_enqueue_script(). This means new versions of the script may not always be loaded due to browser caching.
ERRORMaintainabilitystrip tags strip tags10
- Category
- Maintainability
- Occurrences
- 10
- Severity
- error
Sample message
strip_tags() is discouraged. Use the more comprehensive wp_strip_all_tags() instead.
ERRORMaintainabilityunlink unlink7
- Category
- Maintainability
- Occurrences
- 7
- Severity
- error
Sample message
unlink() is discouraged. Use wp_delete_file() to delete a file.
WARNINGSecuritywp redirect wp redirect6
- Category
- Security
- Occurrences
- 6
- Severity
- warning
Sample message
wp_redirect() found. Using wp_safe_redirect(), along with the "allowed_redirect_hosts" filter if needed, can help avoid any chances of malicious redirects within code. It is also important to remember to call exit() after a redirect so that no other unwanted code is executed.
ERRORMaintainabilitydate date5
- Category
- Maintainability
- Occurrences
- 5
- Severity
- error
Sample message
date() is affected by runtime timezone changes which can cause date/time to be incorrectly displayed. Use gmdate() instead.
ERRORMaintainabilityrename rename4
- Category
- Maintainability
- Occurrences
- 4
- Severity
- error
Sample message
rename() is discouraged. Use WP_Filesystem::move() to rename a file.
WARNINGMaintainabilityNot In Footer4
- Category
- Maintainability
- Occurrences
- 4
- Severity
- warning
Sample message
In footer ($in_footer) is not set explicitly wp_enqueue_script; It is recommended to load scripts in the footer. Please set this value to `true` to load it in the footer, or explicitly `false` if it should be loaded in the header.
WARNINGMaintainabilityNon-prefixed function3
- Category
- Maintainability
- Occurrences
- 3
- Severity
- warning
Sample message
Functions declared in the global namespace by a theme/plugin should start with the theme/plugin prefix. Found: "nm_get_order_id".
ERRORMaintainabilityfile system operations fclose3
- Category
- Maintainability
- Occurrences
- 3
- Severity
- error
Sample message
File operations should use WP_Filesystem methods instead of direct PHP filesystem calls. Found: fclose().
ERRORMaintainabilityfile system operations fopen3
- Category
- Maintainability
- Occurrences
- 3
- Severity
- error
Sample message
File operations should use WP_Filesystem methods instead of direct PHP filesystem calls. Found: fopen().
ERRORSupply ChainHidden files included2
- Category
- Supply Chain
- Occurrences
- 2
- Severity
- error
Sample message
Hidden files are not permitted.
WARNINGI18nDiscouraged text-domain loading1
- Category
- I18n
- Occurrences
- 1
- Severity
- warning
Sample message
load_plugin_textdomain() has been discouraged since WordPress version 4.6. When your plugin is hosted on WordPress.org, you no longer need to manually include this function call for translations under your plugin slug. WordPress will automatically load the translations for you as needed.
ERRORMaintainabilityOffloaded Content1
- Category
- Maintainability
- Occurrences
- 1
- Severity
- error
Sample message
Found call to wp_enqueue_style() with external resource. Offloading styles to your servers or any remote service is disallowed.
External Connections
Potential connections found in static code analysis.
Outbound calls
214
External assets
3
Incoming endpoints
36
Notable Domains
themeisle.com27 · outbound
jqueryui.com13 · outbound
docs.themeisle.com10 · outbound
api.jqueryui.com6 · outbound
api.themeisle.com6 · outbound
ns.adobe.com6 · outbound
Platform / Reference Domains
opensource.org33 · platform/reference
w3.org23 · platform/reference
github.com20 · platform/reference
wordpress.org13 · platform/reference
api.wordpress.org6 · platform/reference
codex.wordpress.org1 · platform/reference
translate.wordpress.org1 · platform/reference
External Asset Domains
cdnjs.cloudflare.com2 · asset + outbound
youtube.com2 · asset + outbound
fonts.googleapis.com1 · asset
Incoming Endpoints
/wp-json/ppom/v1/delete/order/REST
register_rest_route
/wp-json/ppom/v1/delete/product/REST
register_rest_route
/wp-json/ppom/v1/get/id/(?P<id>\d+)REST
register_rest_route
/wp-json/ppom/v1/get/order/REST
register_rest_route
/wp-json/ppom/v1/get/product/REST
register_rest_route
/wp-json/ppom/v1/nonces/file/REST
register_rest_route
Admin AJAX endpoints24
wp_ajax_themeisle_sdk_dismiss_noticeauthenticated
wp_ajax
admin_post_ppom_attachauthenticated
admin_post
admin_post_ppom_export_metaauthenticated
admin_post
admin_post_ppom_migrate_settings_panelauthenticated
admin_post
wp_ajax_ppom_ajax_validationauthenticated
wp_ajax
wp_ajax_ppom_attach_ppomsauthenticated
wp_ajax
wp_ajax_ppom_delete_fileauthenticated
wp_ajax
wp_ajax_ppom_delete_metaauthenticated
wp_ajax
wp_ajax_ppom_delete_selected_metaauthenticated
wp_ajax
wp_ajax_ppom_get_preview_urlauthenticated
wp_ajax
wp_ajax_ppom_get_productsauthenticated
wp_ajax
wp_ajax_ppom_import_templateauthenticated
wp_ajax
12 more hidden
Score History
7 score snapshots
v34.0.8
21
Latest
- Findings
- 1,655
- Errors
- 336
- Warnings
- 1,319
- Check
- 2.0.0
v34.0.7
21
Score
- Findings
- 1,658
- Errors
- 336
- Warnings
- 1,322
- Check
- 2.0.0
| Scan | Score | Findings | Errors | Warnings | Plugin | Check |
|---|---|---|---|---|---|---|
| Latest | 21 | 1,655 | 336 | 1,319 | v34.0.8 | 2.0.0 |
| 21 | 1,658 | 336 | 1,322 | v34.0.7 | 2.0.0 |
Relationship Map
Author, categories, issues, domains, and nearby plugins.
Loading map
PluginAuthorCategoryIssueDomainRelated
Relationship links
Author
Category
Issue
Domain
Related
Yoast SEO – Advanced SEO with real-time guidance and built-in AI24 scoreWooCommerce21 scoreAkismet Anti-spam: Spam Protection35 scoreContact Form 769 scoreElementor Website Builder – more than just a page builder39 scoreClassic Editor63 scoreLiteSpeed Cache35 scoreAll-in-One WP Migration and Backup34 scoreSite Kit by Google – Analytics, Search Console, AdSense, Speed25 scoreAdvanced Custom Fields (ACF®)23 scoreMeta Box95 scoreCheckout Field Editor (Checkout Manager) for WooCommerce41 scoreLightStart – Maintenance Mode, Coming Soon and Landing Page Builder35 scoreOtter Blocks – Gutenberg Blocks, Page Builder for Gutenberg Editor & FSE35 score
Author
Category
Issue
Domain
Related
Yoast SEO – Advanced SEO with real-time guidance and built-in AI24 scoreWooCommerce21 scoreAkismet Anti-spam: Spam Protection35 scoreContact Form 769 scoreElementor Website Builder – more than just a page builder39 scoreClassic Editor63 scoreLiteSpeed Cache35 scoreAll-in-One WP Migration and Backup34 scoreSite Kit by Google – Analytics, Search Console, AdSense, Speed25 scoreAdvanced Custom Fields (ACF®)23 scoreMeta Box95 scoreCheckout Field Editor (Checkout Manager) for WooCommerce41 scoreLightStart – Maintenance Mode, Coming Soon and Landing Page Builder35 scoreOtter Blocks – Gutenberg Blocks, Page Builder for Gutenberg Editor & FSE35 score
Related Plugins
Show only lowest prices in variable products for WooCommerce
6k+ active installs
100
CubeWP Framework
4k+ active installs
100
Product Addons and Product Options With Custom Fields – WowAddons
4k+ active installs
100
MB Elementor Integration
2k+ active installs
99
Repeaterly – ACF Repeater, Flexible Content & Dynamic Tags for Elementor
500 active installs
99
Extra Product Options For WooCommerce | Custom Product Addons and Fields
30k+ active installs
98