WP Crowdfunding

WP Crowdfunding is a WordPress plugin for fundraising/backer sites. This WooCommerce based plugin lets you launch a site like Kickstarter easily.

v2.1.17ThemeumUpdated Added 3k+ installs88% rating
23
Score
199
Errors
1,629
Warnings
+0
Change

Category Scores

Security0
Repo86
Performance100
Maintainability0

Issues to Review

Prioritized issue groups from the latest Plugin Check scan

1,828 findings

Maintainability

1,093

12 issue groups

Security

660

9 issue groups

I18n

44

4 issue groups

WARNINGMaintainabilityNon-prefixed global variableGlobal variables defined by a theme/plugin should start with the theme/plugin prefix. Found: "$addon".916
Category
Maintainability
Occurrences
916
Severity
warning

Sample message

Global variables defined by a theme/plugin should start with the theme/plugin prefix. Found: "$addon".

WARNINGSecurityRequest data is not unslashed$_GET['author'] not unslashed before sanitization. Use wp_unslash() or similar211
Category
Security
Occurrences
211
Severity
warning

Sample message

$_GET['author'] not unslashed before sanitization. Use wp_unslash() or similar

WARNINGSecurityInput is not validatedDetected usage of a possibly undefined superglobal array index: $_GET['postid']. Check that the array index exists before using it.149
Category
Security
Occurrences
149
Severity
warning

Sample message

Detected usage of a possibly undefined superglobal array index: $_GET['postid']. Check that the array index exists before using it.

WARNINGSecurityInput is not sanitizedDetected usage of a non-sanitized input variable: $_GET['author']102
Category
Security
Occurrences
102
Severity
warning

Sample message

Detected usage of a non-sanitized input variable: $_GET['author']

ERRORSecurityOutput is not escapedAll output should be run through an escaping function (see the Security sections in the WordPress Developer Handbooks), found '$_nf_duration_start'.63
Category
Security
Occurrences
63
Severity
error

Sample message

All output should be run through an escaping function (see the Security sections in the WordPress Developer Handbooks), found '$_nf_duration_start'.

WARNINGSecurityNonce verification recommendedProcessing form data without nonce verification.58
Category
Security
Occurrences
58
Severity
warning

Sample message

Processing form data without nonce verification.

WARNINGMaintainabilityNon-prefixed hook nameHook names invoked by a theme/plugin should start with the theme/plugin prefix. Found: "active_plugins".43
Category
Maintainability
Occurrences
43
Severity
warning

Sample message

Hook names invoked by a theme/plugin should start with the theme/plugin prefix. Found: "active_plugins".

WARNINGSecurityMissing nonce verificationProcessing form data without nonce verification.40
Category
Security
Occurrences
40
Severity
warning

Sample message

Processing form data without nonce verification.

ERRORMaintainabilitydate datedate() is affected by runtime timezone changes which can cause date/time to be incorrectly displayed. Use gmdate() instead.38
Category
Maintainability
Occurrences
38
Severity
error

Sample message

date() is affected by runtime timezone changes which can cause date/time to be incorrectly displayed. Use gmdate() instead.

WARNINGMaintainabilityDirect QueryUse of a direct database call is discouraged.19
Category
Maintainability
Occurrences
19
Severity
warning

Sample message

Use of a direct database call is discouraged.

Show 15 more
WARNINGMaintainabilityNo Caching19
Category
Maintainability
Occurrences
19
Severity
warning

Sample message

Direct database call without caching detected. Consider using wp_cache_get() / wp_cache_set() or wp_cache_delete().

ERRORI18nMissing Arg Domain16
Category
I18n
Occurrences
16
Severity
error

Sample message

Missing $domain parameter in function call to __().

WARNINGMaintainabilityslow db query tax query15
Category
Maintainability
Occurrences
15
Severity
warning

Sample message

Detected usage of tax_query, possible slow query.

ERRORSecurityDatabase parameter is not escaped14
Category
Security
Occurrences
14
Severity
error

Sample message

Unescaped parameter $order_status used in $wpdb->get_col()\n$order_status used without escaping.

ERRORSecuritySQL query is not prepared13
Category
Security
Occurrences
13
Severity
error

Sample message

Use placeholders and $wpdb->prepare(); found $order_status

ERRORI18nNon Singular String Literal Text13
Category
I18n
Occurrences
13
Severity
error

Sample message

The $text parameter must be a single text string literal. Found: $location

WARNINGSecurityInterpolated SQL is not prepared10
Category
Security
Occurrences
10
Severity
warning

Sample message

Use placeholders and $wpdb->prepare(); found interpolated variable {$post_id} at "SELECT order_meta.meta_value FROM `{$prefix}woocommerce_order_itemmeta` AS order_meta, `{$prefix}woocommerce_order_items` AS order_item WHERE order_meta.order_item_id IN (SELECT order_item.order_item_id FROM `{$prefix}woocommerce_order_items` as order_item WHERE order_item.order_id = {$post_id}) AND order_meta.order_item_id IN (SELECT meta.order_item_id FROM `{$prefix}woocommerce_order_itemmeta` AS meta WHERE meta.meta_key='_product_id' AND meta.meta_value={$product_id} ) AND order_meta.meta_key='_line_total' GROUP BY order_meta.meta_id"

WARNINGMaintainabilityslow db query meta key10
Category
Maintainability
Occurrences
10
Severity
warning

Sample message

Detected usage of meta_key, possible slow query.

ERRORI18nMissing Translators Comment9
Category
I18n
Occurrences
9
Severity
error

Sample message

A function call to __() with texts containing placeholders was found, but was not accompanied by a "translators:" comment on the line above to clarify the meaning of the placeholders.

ERRORMaintainabilitystrip tags strip tags8
Category
Maintainability
Occurrences
8
Severity
error

Sample message

strip_tags() is discouraged. Use the more comprehensive wp_strip_all_tags() instead.

WARNINGMaintainabilityslow db query meta query7
Category
Maintainability
Occurrences
7
Severity
warning

Sample message

Detected usage of meta_query, possible slow query.

ERRORMaintainabilityMissing direct file access protection7
Category
Maintainability
Occurrences
7
Severity
error

Sample message

PHP file should prevent direct access. Add a check like: if ( ! defined( 'ABSPATH' ) ) exit;

WARNINGMaintainabilityDiscouraged PHP function6
Category
Maintainability
Occurrences
6
Severity
warning

Sample message

query_posts() is discouraged. Use WP_Query instead.

ERRORI18nText Domain Mismatch6
Category
I18n
Occurrences
6
Severity
error

Sample message

Mismatched text domain. Expected 'wp-crowdfunding' but got 'backer'.

WARNINGMaintainabilityNon-prefixed function5
Category
Maintainability
Occurrences
5
Severity
warning

Sample message

Functions declared in the global namespace by a theme/plugin should start with the theme/plugin prefix. Found: "author_name_by_login".

Score History

First score snapshot

v2.1.17

23

Latest

Findings
1,828
Errors
199
Warnings
1,629
Check
2.0.0

Related Plugins

Order Tip for WooCommerce

2k+ active installs

93
Payment Forms for Paystack

3k+ active installs

90
HelloAsso

4k+ active installs

60
Charity Addon for Elementor

1k+ active installs

40
Donations via PayPal

20k+ active installs

40