WP Plugin Info Card

Add beautiful, customizable cards to showcase plugins, themes, and projects from WordPress.org, GitHub, EDD, and third-party plugins.

v6.3.3Brice CapobiancoUpdated 26 days agoAdded 12 years ago500 installs100% rating

Github card cards edd grid

Score

Errors

376

Warnings

Change

Category Scores

Security0

Repo100

Performance100

Maintainability62

Issues to Review

Prioritized issue groups from the latest Plugin Check scan

429 findings

Security

289

8 issue groups

Maintainability

139

12 issue groups

I18n

1 issue group

WARNINGSecurityNonce verification recommendedProcessing form data without nonce verification.106

Category: Security
Occurrences: 106
Severity: warning

Sample message

Processing form data without nonce verification.

WordPress.Security.NonceVerification.Recommended

WARNINGMaintainabilityNon-prefixed global variableGlobal variables defined by a theme/plugin should start with the theme/plugin prefix. Found: "$active_installs_text".96

Category: Maintainability
Occurrences: 96
Severity: warning

Sample message

Global variables defined by a theme/plugin should start with the theme/plugin prefix. Found: "$active_installs_text".

WordPress.NamingConventions.PrefixAllGlobals.NonPrefixedVariableFound

WARNINGSecurityRequest data is not unslashed$_GET['ajax'] not unslashed before sanitization. Use wp_unslash() or similar62

Category: Security
Occurrences: 62
Severity: warning

Sample message

$_GET['ajax'] not unslashed before sanitization. Use wp_unslash() or similar

WordPress.Security.ValidatedSanitizedInput.MissingUnslash

WARNINGSecurityInput is not sanitizedDetected usage of a non-sanitized input variable: $_GET['ajax']61

Category: Security
Occurrences: 61
Severity: warning

Sample message

Detected usage of a non-sanitized input variable: $_GET['ajax']

WordPress.Security.ValidatedSanitizedInput.InputNotSanitized

ERRORSecurityOutput is not escapedAll output should be run through an escaping function (see the Security sections in the WordPress Developer Handbooks), found '$content'.28

Category: Security
Occurrences: 28
Severity: error

Sample message

All output should be run through an escaping function (see the Security sections in the WordPress Developer Handbooks), found '$content'.

WordPress.Security.EscapeOutput.OutputNotEscaped Reference

WARNINGSecurityMissing nonce verificationProcessing form data without nonce verification.15

Category: Security
Occurrences: 15
Severity: warning

Sample message

Processing form data without nonce verification.

WordPress.Security.NonceVerification.Missing

ERRORMaintainabilityMissing direct file access protectionPHP file should prevent direct access. Add a check like: if ( ! defined( 'ABSPATH' ) ) exit;15

Category: Maintainability
Occurrences: 15
Severity: error

Sample message

PHP file should prevent direct access. Add a check like: if ( ! defined( 'ABSPATH' ) ) exit;

missing_direct_file_access_protection Reference

WARNINGSecurityInput is not validatedDetected usage of a possibly undefined superglobal array index: $_GET['cols']. Check that the array index exists before using it.8

Category: Security
Occurrences: 8
Severity: warning

Sample message

Detected usage of a possibly undefined superglobal array index: $_GET['cols']. Check that the array index exists before using it.

WordPress.Security.ValidatedSanitizedInput.InputNotValidated

WARNINGMaintainabilityDirect QueryUse of a direct database call is discouraged.6

Category: Maintainability
Occurrences: 6
Severity: warning

Sample message

Use of a direct database call is discouraged.

WordPress.DB.DirectDatabaseQuery.DirectQuery

WARNINGMaintainabilityNo CachingDirect database call without caching detected. Consider using wp_cache_get() / wp_cache_set() or wp_cache_delete().6

Category: Maintainability
Occurrences: 6
Severity: warning

Sample message

Direct database call without caching detected. Consider using wp_cache_get() / wp_cache_set() or wp_cache_delete().

WordPress.DB.DirectDatabaseQuery.NoCaching

Show 11 more

ERRORSecurityException output is not escaped6

Category: Security
Occurrences: 6
Severity: error

Sample message

All output should be run through an escaping function (see the Security sections in the WordPress Developer Handbooks), found '$err'.

WordPress.Security.EscapeOutput.ExceptionNotEscaped Reference

WARNINGMaintainabilityNon-prefixed hook name3

Category: Maintainability
Occurrences: 3
Severity: warning

Sample message

Hook names invoked by a theme/plugin should start with the theme/plugin prefix. Found: "all_plugins".

WordPress.NamingConventions.PrefixAllGlobals.NonPrefixedHooknameFound

ERRORSecurityUnsafe printing function3

Category: Security
Occurrences: 3
Severity: error

Sample message

All output should be run through an escaping function (like esc_html_e() or esc_attr_e()), found '_e'.

WordPress.Security.EscapeOutput.UnsafePrintingFunction Reference

WARNINGMaintainabilityMissing Version3

Category: Maintainability
Occurrences: 3
Severity: warning

Sample message

Resource version not set in call to wp_register_script(). This means new versions of the script may not always be loaded due to browser caching.

WordPress.WP.EnqueuedResourceParameters.MissingVersion

WARNINGMaintainabilityNot In Footer3

Category: Maintainability
Occurrences: 3
Severity: warning

Sample message

In footer ($in_footer) is not set explicitly wp_register_script; It is recommended to load scripts in the footer. Please set this value to `true` to load it in the footer, or explicitly `false` if it should be loaded in the header.

WordPress.WP.EnqueuedResourceParameters.NotInFooter

WARNINGMaintainabilitytrademarked term3

Category: Maintainability
Occurrences: 3
Severity: warning

Sample message

The plugin name includes a restricted term. Your chosen plugin name - "WP Plugin Info Card" - contains the restricted term "plugin" which cannot be used at all in your plugin name.

trademarked_term

WARNINGMaintainabilityNo PHP code found1

Category: Maintainability
Occurrences: 1
Severity: warning

Sample message

No PHP code was found in this file and short open tags are not allowed by this install of PHP. This file may be using short open tags but PHP does not allow them.

Internal.NoCodeFound

WARNINGI18nDiscouraged text-domain loading1

Category: I18n
Occurrences: 1
Severity: warning

Sample message

load_plugin_textdomain() has been discouraged since WordPress version 4.6. When your plugin is hosted on WordPress.org, you no longer need to manually include this function call for translations under your plugin slug. WordPress will automatically load the translations for you as needed.

PluginCheck.CodeAnalysis.DiscouragedFunctions.load_plugin_textdomainFound Reference

WARNINGMaintainabilityslow db query meta query1

Category: Maintainability
Occurrences: 1
Severity: warning

Sample message

Detected usage of meta_query, possible slow query.

WordPress.DB.SlowDBQuery.slow_db_query_meta_query

WARNINGMaintainabilityerror log trigger error1

Category: Maintainability
Occurrences: 1
Severity: warning

Sample message

trigger_error() found. Debug code should not normally be used in production.

WordPress.PHP.DevelopmentFunctions.error_log_trigger_error

ERRORMaintainabilityfile system operations fwrite1

Category: Maintainability
Occurrences: 1
Severity: error

Sample message

File operations should use WP_Filesystem methods instead of direct PHP filesystem calls. Found: fwrite().

WordPress.WP.AlternativeFunctions.file_system_operations_fwrite

External Connections

Potential connections found in static code analysis.

33 domains

Outbound calls

206

External assets

Incoming endpoints

Notable Domains

player.vimeo.com8 · outbound

schemas.wp.org7 · outbound

dlxplugins.com6 · outbound

google.com6 · outbound

api.github.com5 · outbound

b-website.com5 · outbound

Platform / Reference Domains

w3.org92 · platform/reference

wordpress.org17 · platform/reference

github.com8 · platform/reference

make.wordpress.org5 · platform/reference

profiles.wordpress.org3 · platform/reference

gnu.org1 · platform/reference

External Asset Domains

No external asset domains detected.

Incoming Endpoints

/wp-json/wppic/v1/custom-plugins/importREST

register_rest_route

/wp-json/wppic/v1/custom-plugins/import-from-restREST

register_rest_route

/wp-json/wppic/v1/custom-plugins/import-from-rest/refreshREST

register_rest_route

/wp-json/wppic/v1/get_htmlREST

register_rest_route

/wp-json/wppic/v1/get_queryREST

register_rest_route

/wp-json/wppic/v1/plugins/(?P<slug>[-_a-zA-Z0-9]+)/(?P<passcode>[-_a-zA-Z0-9]+)REST

register_rest_route

Admin AJAX endpoints30

wp_ajax_async_wppic_shortcode_contentauthenticated

wp_ajax

wp_ajax_wppic_authenticate_with_githubauthenticated

wp_ajax

wp_ajax_wppic_check_pluginauthenticated

wp_ajax

wp_ajax_wppic_check_plugin_slugauthenticated

wp_ajax

wp_ajax_wppic_check_themeauthenticated

wp_ajax

wp_ajax_wppic_clear_cacheauthenticated

wp_ajax

wp_ajax_wppic_clear_cache_optionsauthenticated

wp_ajax

wp_ajax_wppic_delete_custom_pluginauthenticated

wp_ajax

wp_ajax_wppic_delete_pluginauthenticated

wp_ajax

wp_ajax_wppic_delete_screenshot_presetauthenticated

wp_ajax

wp_ajax_wppic_detach_custom_plugin_from_restauthenticated

wp_ajax

wp_ajax_wppic_edit_screenshot_presetauthenticated

wp_ajax

18 more hidden

Score History

First score snapshot

2 days ago

v6.3.3

Latest

Findings: 429
Errors: 53
Warnings: 376
Check: 2.0.0

Scan	Score	Findings	Errors	Warnings	Plugin	Check
2 days agoLatest	37	429	53	376	v6.3.3	2.0.0

Relationship Map

Author, categories, issues, domains, and nearby plugins.

37 nodes

Loading map

PluginAuthorCategoryIssueDomainRelated

Relationship links

Issue

Domain

player.vimeo.com8 signals schemas.wp.org7 signals dlxplugins.com6 signals google.com6 signals api.github.com5 signals b-website.com5 signals mediaron.com4 signals creativecommons.org3 signals

Related Plugins

Bookmark Card

700 active installs

Embed Block for GitHub

400 active installs

Event Block

1k+ active installs

Trust Badges

1k+ active installs

WN Elementor Glassy Columns

1k+ active installs

Wikipedia Preview

1k+ active installs