PluginScore

WP-Polls

Adds an AJAX poll system to your WordPress blog. You can also easily add a poll into your WordPress's blog post/page.

v2.77.3Lester ChanUpdated Added 40k+ installs84% rating
boothpollpollingpollsvote
25
Score
618
Errors
639
Warnings
+0
Change

Category Scores

Security0
Repo80
Performance100
Maintainability14

Issues to Review

Prioritized issue groups from the latest Plugin Check scan

1,257 findings

Security

719

12 issue groups

Maintainability

451

10 issue groups

I18n

76

3 issue groups

ERRORSecurityUnsafe printing functionAll output should be run through an escaping function (like esc_html_e() or esc_attr_e()), found '_e'.285
Category
Security
Occurrences
285
Severity
error

Sample message

All output should be run through an escaping function (like esc_html_e() or esc_attr_e()), found '_e'.

WordPress.Security.EscapeOutput.UnsafePrintingFunctionReference
ERRORSecurityOutput is not escapedAll output should be run through an escaping function (see the Security sections in the WordPress Developer Handbooks), found '" <input type=\"text\" size=\"4\" id=\"polla_votes-$polla_aid\" name=\"polla_votes-$polla_aid\" value=\"$polla_votes\" onblur=\"check_totalvotes();\" /></td>\n</tr>\n"'.208
Category
Security
Occurrences
208
Severity
error

Sample message

All output should be run through an escaping function (see the Security sections in the WordPress Developer Handbooks), found '" <input type=\"text\" size=\"4\" id=\"polla_votes-$polla_aid\" name=\"polla_votes-$polla_aid\" value=\"$polla_votes\" onblur=\"check_totalvotes();\" /></td>\n</tr>\n"'.

WordPress.Security.EscapeOutput.OutputNotEscapedReference
WARNINGMaintainabilityNon-prefixed global variableGlobal variables defined by a theme/plugin should start with the theme/plugin prefix. Found: &quot;$add_poll_answers&quot;.200
Category
Maintainability
Occurrences
200
Severity
warning

Sample message

Global variables defined by a theme/plugin should start with the theme/plugin prefix. Found: &quot;$add_poll_answers&quot;.

WordPress.NamingConventions.PrefixAllGlobals.NonPrefixedVariableFound
WARNINGMaintainabilityDirect QueryUse of a direct database call is discouraged.88
Category
Maintainability
Occurrences
88
Severity
warning

Sample message

Use of a direct database call is discouraged.

WordPress.DB.DirectDatabaseQuery.DirectQuery
WARNINGMaintainabilityNo CachingDirect database call without caching detected. Consider using wp_cache_get() / wp_cache_set() or wp_cache_delete().78
Category
Maintainability
Occurrences
78
Severity
warning

Sample message

Direct database call without caching detected. Consider using wp_cache_get() / wp_cache_set() or wp_cache_delete().

WordPress.DB.DirectDatabaseQuery.NoCaching
WARNINGSecurityInput is not validatedDetected usage of a possibly undefined superglobal array index: $_POST[&#039;delete_logs_yes&#039;]. Check that the array index exists before using it.60
Category
Security
Occurrences
60
Severity
warning

Sample message

Detected usage of a possibly undefined superglobal array index: $_POST[&#039;delete_logs_yes&#039;]. Check that the array index exists before using it.

WordPress.Security.ValidatedSanitizedInput.InputNotValidated
ERRORI18nMissing Translators CommentA function call to __() with texts containing placeholders was found, but was not accompanied by a "translators:" comment on the line above to clarify the meaning of the placeholders.60
Category
I18n
Occurrences
60
Severity
error

Sample message

A function call to __() with texts containing placeholders was found, but was not accompanied by a "translators:" comment on the line above to clarify the meaning of the placeholders.

WordPress.WP.I18n.MissingTranslatorsCommentReference
WARNINGSecurityRequest data is not unslashed$_COOKIE[&#039;comment_author_&#039; . COOKIEHASH] not unslashed before sanitization. Use wp_unslash() or similar46
Category
Security
Occurrences
46
Severity
warning

Sample message

$_COOKIE[&#039;comment_author_&#039; . COOKIEHASH] not unslashed before sanitization. Use wp_unslash() or similar

WordPress.Security.ValidatedSanitizedInput.MissingUnslash
WARNINGSecurityInput is not sanitizedDetected usage of a non-sanitized input variable: $_COOKIE[&#039;comment_author_&#039; . COOKIEHASH]40
Category
Security
Occurrences
40
Severity
warning

Sample message

Detected usage of a non-sanitized input variable: $_COOKIE[&#039;comment_author_&#039; . COOKIEHASH]

WordPress.Security.ValidatedSanitizedInput.InputNotSanitized
WARNINGMaintainabilityNon-prefixed hook nameHook names invoked by a theme/plugin should start with the theme/plugin prefix. Found: &quot;wp_polls_add_poll&quot;.32
Category
Maintainability
Occurrences
32
Severity
warning

Sample message

Hook names invoked by a theme/plugin should start with the theme/plugin prefix. Found: &quot;wp_polls_add_poll&quot;.

WordPress.NamingConventions.PrefixAllGlobals.NonPrefixedHooknameFound
Show 15 more
WARNINGSecurityInterpolated SQL is not prepared31
Category
Security
Occurrences
31
Severity
warning

Sample message

Use placeholders and $wpdb-&gt;prepare(); found interpolated variable $comment_sql at &quot;SELECT $wpdb-&gt;pollsip.* FROM $wpdb-&gt;pollsip WHERE pollip_qid = $poll_id $users_voted_for_sql $registered_sql $comment_sql $guest_sql $what_user_voted_sql $num_choices_sql ORDER BY $order_by&quot;

WordPress.DB.PreparedSQL.InterpolatedNotPrepared
WARNINGMaintainabilityNon-prefixed function28
Category
Maintainability
Occurrences
28
Severity
warning

Sample message

Functions declared in the global namespace by a theme/plugin should start with the theme/plugin prefix. Found: &quot;_polls_get_ans_result_sort&quot;.

WordPress.NamingConventions.PrefixAllGlobals.NonPrefixedFunctionFound
ERRORSecurityException output is not escaped16
Category
Security
Occurrences
16
Severity
error

Sample message

All output should be run through an escaping function (see the Security sections in the WordPress Developer Handbooks), found '$poll_id'.

WordPress.Security.EscapeOutput.ExceptionNotEscapedReference
ERRORI18nUnordered Placeholders Text15
Category
I18n
Occurrences
15
Severity
error

Sample message

Multiple placeholders in translatable strings should be ordered. Expected "%1$s, %2$s", but got "%s, %s" in '%s @ %s'.

WordPress.WP.I18n.UnorderedPlaceholdersTextReference
WARNINGSecurityNonce verification recommended12
Category
Security
Occurrences
12
Severity
warning

Sample message

Processing form data without nonce verification.

WordPress.Security.NonceVerification.Recommended
ERRORSecurityDatabase parameter is not escaped10
Category
Security
Occurrences
10
Severity
error

Sample message

Unescaped parameter $log_expiry_sql used in $wpdb->get_col()\n$log_expiry_sql assigned unsafely at line 373.

PluginCheck.Security.DirectDB.UnescapedDBParameter
WARNINGMaintainabilitySchema Change9
Category
Maintainability
Occurrences
9
Severity
warning

Sample message

Attempting a database schema change is discouraged.

WordPress.DB.DirectDatabaseQuery.SchemaChange
ERRORMaintainabilityMissing direct file access protection6
Category
Maintainability
Occurrences
6
Severity
error

Sample message

PHP file should prevent direct access. Add a check like: if ( ! defined( 'ABSPATH' ) ) exit;

missing_direct_file_access_protectionReference
WARNINGSecurityMissing nonce verification5
Category
Security
Occurrences
5
Severity
warning

Sample message

Processing form data without nonce verification.

WordPress.Security.NonceVerification.Missing
ERRORMaintainabilitystrip tags strip tags5
Category
Maintainability
Occurrences
5
Severity
error

Sample message

strip_tags() is discouraged. Use the more comprehensive wp_strip_all_tags() instead.

WordPress.WP.AlternativeFunctions.strip_tags_strip_tags
WARNINGSecurityDatabase parameter is not escaped3
Category
Security
Occurrences
3
Severity
warning

Sample message

Unescaped parameter $order_by used in $wpdb-&gt;get_results()\n$sort_order used without escaping.

PluginCheck.Security.DirectDB.UnescapedDBParameter
ERRORSecuritySQL query is not prepared3
Category
Security
Occurrences
3
Severity
error

Sample message

Use placeholders and $wpdb->prepare(); found current_time

WordPress.DB.PreparedSQL.NotPrepared
WARNINGMaintainabilitytrademarked term3
Category
Maintainability
Occurrences
3
Severity
warning

Sample message

The plugin name includes a restricted term. Your chosen plugin name - "WP-Polls" - contains the restricted term "wp" which cannot be used at all in your plugin name.

trademarked_term
ERRORMaintainabilityDeprecated function: wp_get_sites2
Category
Maintainability
Occurrences
2
Severity
error

Sample message

wp_get_sites() has been deprecated since WordPress version 4.6.0. Use get_sites() instead.

WordPress.WP.DeprecatedFunctions.wp_get_sitesFound
WARNINGI18nDiscouraged text-domain loading1
Category
I18n
Occurrences
1
Severity
warning

Sample message

load_plugin_textdomain() has been discouraged since WordPress version 4.6. When your plugin is hosted on WordPress.org, you no longer need to manually include this function call for translations under your plugin slug. WordPress will automatically load the translations for you as needed.

PluginCheck.CodeAnalysis.DiscouragedFunctions.load_plugin_textdomainFoundReference

External Connections

Not analyzed yet.

Score History

First score snapshot

v2.77.3

25

Latest

Findings
1,257
Errors
618
Warnings
639
Check
2.0.0

Relationship Map

Author, categories, issues, domains, and nearby plugins.

29 nodes

Related Plugins

Crowdsignal Forms

200k+ active installs

100
YOP Poll

10k+ active installs

100
SurveyX Builder – Easy Feedback, Poll, Quiz & Survey

2k+ active installs

81
Interact: Embed A Quiz On Your Site

3k+ active installs

78
TotalSurvey for Survey, Quiz and Form

600 active installs

46
Quiz Maker, Poll Maker & Survey Maker by Opinion Stage

6k+ active installs

35