Compress and optimize images, enable lazy load, serve WebP & AVIF, and speed up your site with a global image CDN.
v4.2.0WPMU DEV - Your All-in-One WordPress PlatformUpdated Added 1m+ installs96% rating100% support resolved
25
Score
244
Errors
568
Warnings
+0
Change
Category Scores
Security0
Repo100
Performance100
Maintainability0
Issues to Review
Prioritized issue groups from the latest Plugin Check scan
Maintainability
395
14 issue groups
Security
257
10 issue groups
I18n
113
1 issue group
WARNINGMaintainabilityNon-prefixed hook nameHook names invoked by a theme/plugin should start with the theme/plugin prefix. Found: "'wp_smush_localize_ui_script_data_' . str_replace( '-', '_', $page_slug )".154
- Category
- Maintainability
- Occurrences
- 154
- Severity
- warning
Sample message
Hook names invoked by a theme/plugin should start with the theme/plugin prefix. Found: "'wp_smush_localize_ui_script_data_' . str_replace( '-', '_', $page_slug )".
ERRORI18nText Domain MismatchMismatched text domain. Expected 'wp-smushit' but got 'plugin-cross-sell-textdomain'.113
- Category
- I18n
- Occurrences
- 113
- Severity
- error
Sample message
Mismatched text domain. Expected 'wp-smushit' but got 'plugin-cross-sell-textdomain'.
WARNINGSecurityInterpolated SQL is not preparedUse placeholders and $wpdb->prepare(); found interpolated variable $column at \t\t\t\tSET `$column` = '$option_key',\n96
- Category
- Security
- Occurrences
- 96
- Severity
- warning
Sample message
Use placeholders and $wpdb->prepare(); found interpolated variable $column at \t\t\t\tSET `$column` = '$option_key',\n
WARNINGMaintainabilityDirect QueryUse of a direct database call is discouraged.56
- Category
- Maintainability
- Occurrences
- 56
- Severity
- warning
Sample message
Use of a direct database call is discouraged.
WARNINGMaintainabilityNo CachingDirect database call without caching detected. Consider using wp_cache_get() / wp_cache_set() or wp_cache_delete().53
- Category
- Maintainability
- Occurrences
- 53
- Severity
- warning
Sample message
Direct database call without caching detected. Consider using wp_cache_get() / wp_cache_set() or wp_cache_delete().
WARNINGMaintainabilityNon-prefixed global variableGlobal variables defined by a theme/plugin should start with the theme/plugin prefix. Found: "$_tests_dir".40
- Category
- Maintainability
- Occurrences
- 40
- Severity
- warning
Sample message
Global variables defined by a theme/plugin should start with the theme/plugin prefix. Found: "$_tests_dir".
WARNINGSecurityNonce verification recommendedProcessing form data without nonce verification.32
- Category
- Security
- Occurrences
- 32
- Severity
- warning
Sample message
Processing form data without nonce verification.
ERRORSecuritySQL query is not preparedUse placeholders and $wpdb->prepare(); found $posts_query27
- Category
- Security
- Occurrences
- 27
- Severity
- error
Sample message
Use placeholders and $wpdb->prepare(); found $posts_query
WARNINGSecurityMissing nonce verificationProcessing form data without nonce verification.27
- Category
- Security
- Occurrences
- 27
- Severity
- warning
Sample message
Processing form data without nonce verification.
WARNINGSecurityInput is not sanitizedDetected usage of a non-sanitized input variable: $_GET['instance_id']22
- Category
- Security
- Occurrences
- 22
- Severity
- warning
Sample message
Detected usage of a non-sanitized input variable: $_GET['instance_id']
Show 15 moreShow less
WARNINGMaintainabilityNon-prefixed constant21
- Category
- Maintainability
- Occurrences
- 21
- Severity
- warning
Sample message
Global constants defined by a theme/plugin should start with the theme/plugin prefix. Found: "WP_SHARED_UI_VERSION".
ERRORMaintainabilityMissing direct file access protection20
- Category
- Maintainability
- Occurrences
- 20
- Severity
- error
Sample message
PHP file should prevent direct access. Add a check like: if ( ! defined( 'ABSPATH' ) ) exit;
WARNINGMaintainabilityDynamic hook name15
- Category
- Maintainability
- Occurrences
- 15
- Severity
- warning
Sample message
Hook names invoked by a theme/plugin should start with the theme/plugin prefix. Found: "$old_hook".
ERRORSecurityDatabase parameter is not escaped13
- Category
- Security
- Occurrences
- 13
- Severity
- error
Sample message
Unescaped parameter $column used in $wpdb->query()\n$column assigned unsafely at line 154.
WARNINGSecurityDatabase parameter is not escaped12
- Category
- Security
- Occurrences
- 12
- Severity
- warning
Sample message
Unescaped parameter $query used in $wpdb->get_col()\n$query assigned unsafely at line 163.
ERRORSecurityOutput is not escaped12
- Category
- Security
- Occurrences
- 12
- Severity
- error
Sample message
All output should be run through an escaping function (see the Security sections in the WordPress Developer Handbooks), found '"Could not find $_tests_dir/includes/functions.php, have you run bin/install-wp-tests.sh ?"'.
ERRORSecurityException output is not escaped10
- Category
- Security
- Occurrences
- 10
- Severity
- error
Sample message
All output should be run through an escaping function (see the Security sections in the WordPress Developer Handbooks), found '$file['error']'.
WARNINGMaintainabilityerror log error log7
- Category
- Maintainability
- Occurrences
- 7
- Severity
- warning
Sample message
error_log() found. Debug code should not normally be used in production.
WARNINGSecurityRequest data is not unslashed6
- Category
- Security
- Occurrences
- 6
- Severity
- warning
Sample message
$_GET['page'] not unslashed before sanitization. Use wp_unslash() or similar
ERRORMaintainabilityparse url parse url6
- Category
- Maintainability
- Occurrences
- 6
- Severity
- error
Sample message
parse_url() is discouraged because of inconsistency in the output across PHP versions; use wp_parse_url() instead.
ERRORMaintainabilityfive star reviews detected6
- Category
- Maintainability
- Occurrences
- 6
- Severity
- error
Sample message
Linking directly to 5 stars reviews is not allowed.
ERRORMaintainabilityunlink unlink5
- Category
- Maintainability
- Occurrences
- 5
- Severity
- error
Sample message
unlink() is discouraged. Use wp_delete_file() to delete a file.
ERRORMaintainabilityOffloaded Content4
- Category
- Maintainability
- Occurrences
- 4
- Severity
- error
Sample message
Offloading images, js, css, and other scripts to your servers or any remote service is disallowed.
WARNINGMaintainabilityNon-prefixed class4
- Category
- Maintainability
- Occurrences
- 4
- Severity
- warning
Sample message
Classes declared by a theme/plugin should start with the theme/plugin prefix. Found: "Testable_Mixpanel".
ERRORMaintainabilityfile system operations fclose4
- Category
- Maintainability
- Occurrences
- 4
- Severity
- error
Sample message
File operations should use WP_Filesystem methods instead of direct PHP filesystem calls. Found: fclose().
External Connections
Potential connections found in static code analysis.
Outbound calls
244
External assets
49
Incoming endpoints
7
Notable Domains
wpmudev.com12 · outbound
tailwindcss.com7 · outbound
incsub.com3 · outbound
stackoverflow.com3 · outbound
developers.google.com1 · outbound
facebook.com1 · outbound
Platform / Reference Domains
github.com13 · platform/reference
wordpress.org6 · platform/reference
w3.org5 · platform/reference
developer.wordpress.org1 · platform/reference
External Asset Domains
smushcdn.com220 · asset + outbound
fonts.googleapis.com6 · asset
ci3.googleusercontent.com3 · asset
fonts.bunny.net3 · asset
mcusercontent.com1 · asset
Incoming Endpoints
/wp-json/wp-smush/v1/preset_configs/REST
register_rest_route
wp_ajax_nopriv_public
wp_ajax
Admin AJAX endpoints4
wp_ajax_$actionauthenticated
wp_ajax
wp_ajax_reset_settingsauthenticated
wp_ajax
wp_ajax_skip_media_hub_connectauthenticated
wp_ajax
wp_ajax_smush_save_settingsauthenticated
wp_ajax
Score History
3 score snapshots
v4.2.0
25
Latest
- Findings
- 812
- Errors
- 244
- Warnings
- 568
- Check
- 2.0.0
v4.1.2
25
Score
- Findings
- 818
- Errors
- 252
- Warnings
- 566
- Check
- 2.0.0
| Scan | Score | Findings | Errors | Warnings | Plugin | Check |
|---|---|---|---|---|---|---|
| Latest | 25 | 812 | 244 | 568 | v4.2.0 | 2.0.0 |
| 25 | 818 | 252 | 566 | v4.1.2 | 2.0.0 |
Relationship Map
Author, categories, issues, domains, and nearby plugins.
Loading map
PluginAuthorCategoryIssueDomainRelated
Relationship links
Category
Issue
Domain
Related
Image Optimization – Compress Images and Convert to WebP or AVIF87 scoreYoast SEO – Advanced SEO with real-time guidance and built-in AI24 scoreLiteSpeed Cache35 scoreContact Form 769 scoreElementor Website Builder – more than just a page builder39 scoreWooCommerce21 scoreAkismet Anti-spam: Spam Protection35 scoreSite Kit by Google – Analytics, Search Console, AdSense, Speed25 scoreWordfence Security – Firewall, Malware Scan, and Login Security21 scoreJetpack – WP Security, Backup, Speed, & Growth22 scoreReally Simple Security – Simple and Performant Security (formerly Really Simple SSL)19 scoreImagify Image Optimization: Optimize Images | Compress & Convert to WebP/AVIF21 scoreForminator Forms – Contact Form, Payment Form & Custom Form Builder24 scoreConverter for Media – Optimize images | Convert WebP & AVIF35 score
Category
Issue
Domain
Related
Image Optimization – Compress Images and Convert to WebP or AVIF87 scoreYoast SEO – Advanced SEO with real-time guidance and built-in AI24 scoreLiteSpeed Cache35 scoreContact Form 769 scoreElementor Website Builder – more than just a page builder39 scoreWooCommerce21 scoreAkismet Anti-spam: Spam Protection35 scoreSite Kit by Google – Analytics, Search Console, AdSense, Speed25 scoreWordfence Security – Firewall, Malware Scan, and Login Security21 scoreJetpack – WP Security, Backup, Speed, & Growth22 scoreReally Simple Security – Simple and Performant Security (formerly Really Simple SSL)19 scoreImagify Image Optimization: Optimize Images | Compress & Convert to WebP/AVIF21 scoreForminator Forms – Contact Form, Payment Form & Custom Form Builder24 scoreConverter for Media – Optimize images | Convert WebP & AVIF35 score
Related Plugins
PixelCraft with WebP
500 active installs
100
Image Regenerate & Select Crop
8k+ active installs
99
Upload Converter for WebP
400 active installs
95
Image Optimization – Compress Images and Convert to WebP or AVIF
1m+ active installs
87
ImageKit – URL based image manipulation and optimization
1k+ active installs
87
QODE Optimizer
30k+ active installs
74