Securely accept payments, synchronize sales, and seamlessly manage inventory and product data between WooCommerce and Square POS.
Category Scores
Top Issues by Category
maintainability265
Issues Details
272 issues found in latest scan
Hook names invoked by a theme/plugin should start with the theme/plugin prefix. Found: "'wc_payment_gateway_' . $this->get_id() . '_supports_' . str_replace( '-', '_', $name )".
Direct database call without caching detected. Consider using wp_cache_get() / wp_cache_set() or wp_cache_delete().
Global variables defined by a theme/plugin should start with the theme/plugin prefix. Found: "$action_key".
Hook names invoked by a theme/plugin should start with the theme/plugin prefix. Found: "{$this->identifier}_cron_interval".
Global constants defined by a theme/plugin should start with the theme/plugin prefix. Found: "DOING_SQUARE_SYNC".
PHP file should prevent direct access. Add a check like: if ( ! defined( 'ABSPATH' ) ) exit;
Unescaped parameter $meta_key_in used in $wpdb->query()\n$meta_key_in assigned unsafely at line 1501.
Classes declared by a theme/plugin should start with the theme/plugin prefix. Found: "WC_Square_Access_Token_Email".
The plugin name includes a restricted term. Your chosen plugin name - "WooCommerce Square" - contains the restricted term "woocommerce" which cannot be used within in your plugin name, unless your plugin name contains one of the allowed patterns: "for woocommerce", "with woocommerce", "using woocommerce", or "and woocommerce". The term must still not appear anywhere else in your name.
Detected usage of a non-sanitized input variable: $_REQUEST['data']
Functions declared in the global namespace by a theme/plugin should start with the theme/plugin prefix. Found: "wc_square".
In footer ($in_footer) is not set explicitly wp_enqueue_script; It is recommended to load scripts in the footer. Please set this value to `true` to load it in the footer, or explicitly `false` if it should be loaded in the header.
The "/vendor" directory using composer exists, but "composer.json" file is missing.
| Code | Type | Message | Count |
|---|---|---|---|
| WordPress.NamingConventions.PrefixAllGlobals.NonPrefixedHooknameFound | WARNING | Hook names invoked by a theme/plugin should start with the theme/plugin prefix. Found: "'wc_payment_gateway_' . $this->get_id() . '_supports_' . str_replace( '-', '_', $name )". | 150 |
| WordPress.DB.DirectDatabaseQuery.DirectQuery | WARNING | Use of a direct database call is discouraged. | 28 |
| WordPress.DB.DirectDatabaseQuery.NoCaching | WARNING | Direct database call without caching detected. Consider using wp_cache_get() / wp_cache_set() or wp_cache_delete(). | 26 |
| WordPress.NamingConventions.PrefixAllGlobals.NonPrefixedVariableFound | WARNING | Global variables defined by a theme/plugin should start with the theme/plugin prefix. Found: "$action_key". | 26 |
| WordPress.NamingConventions.PrefixAllGlobals.DynamicHooknameFound | WARNING | Hook names invoked by a theme/plugin should start with the theme/plugin prefix. Found: "{$this->identifier}_cron_interval". | 12 |
| WordPress.NamingConventions.PrefixAllGlobals.NonPrefixedConstantFound | WARNING | Global constants defined by a theme/plugin should start with the theme/plugin prefix. Found: "DOING_SQUARE_SYNC". | 8 |
| missing_direct_file_access_protection | ERROR | PHP file should prevent direct access. Add a check like: if ( ! defined( 'ABSPATH' ) ) exit; | 6 |
| PluginCheck.Security.DirectDB.UnescapedDBParameter | WARNING | Unescaped parameter $meta_key_in used in $wpdb->query()\n$meta_key_in assigned unsafely at line 1501. | 5 |
| WordPress.NamingConventions.PrefixAllGlobals.NonPrefixedClassFound | WARNING | Classes declared by a theme/plugin should start with the theme/plugin prefix. Found: "WC_Square_Access_Token_Email". | 3 |
| trademarked_term | WARNING | The plugin name includes a restricted term. Your chosen plugin name - "WooCommerce Square" - contains the restricted term "woocommerce" which cannot be used within in your plugin name, unless your plugin name contains one of the allowed patterns: "for woocommerce", "with woocommerce", "using woocommerce", or "and woocommerce". The term must still not appear anywhere else in your name. | 3 |
| WordPress.Security.ValidatedSanitizedInput.InputNotSanitized | WARNING | Detected usage of a non-sanitized input variable: $_REQUEST['data'] | 2 |
| WordPress.NamingConventions.PrefixAllGlobals.NonPrefixedFunctionFound | WARNING | Functions declared in the global namespace by a theme/plugin should start with the theme/plugin prefix. Found: "wc_square". | 1 |
| WordPress.WP.EnqueuedResourceParameters.NotInFooter | WARNING | In footer ($in_footer) is not set explicitly wp_enqueue_script; It is recommended to load scripts in the footer. Please set this value to `true` to load it in the footer, or explicitly `false` if it should be loaded in the header. | 1 |
| missing_composer_json_file | WARNING | The "/vendor" directory using composer exists, but "composer.json" file is missing. | 1 |
Latest Snapshot
Findings
272
Errors
6
Warnings
266
Score History
First score snapshot
First scan completed Jun 20, 2026
v5.4.0 · Plugin Check 2.0.0 · Model 2026.06-mvp-static-v2
Jun 20, 2026
v5.4.0
78
Latest
- Findings
- 272
- Errors
- 6
- Warnings
- 266
- Plugin Check
- 2.0.0
- Model
- 2026.06-mvp-static-v2
| Scan | Score | Findings | Errors | Warnings | Plugin | Plugin Check | Model |
|---|---|---|---|---|---|---|---|
| Jun 20, 2026Latest | 78 | 272 | 6 | 266 | v5.4.0 | 2.0.0 | 2026.06-mvp-static-v2 |