Subscribe Forms – Beautiful Email Forms, Embedded Newsletter Forms & MailChimp Form

Use Subscribe Forms to grow your email subscriber lists with Subscribe Forms built-in email forms templates and integrations 📧

v1.6.2PremioUpdated Added 2k+ installs94% rating100% support resolved
23
Score
419
Errors
542
Warnings
+0
Change

Category Scores

Security0
Repo86
Performance98
Maintainability0

Issues to Review

Prioritized issue groups from the latest Plugin Check scan

961 findings

Security

435

12 issue groups

Maintainability

313

10 issue groups

I18n

149

3 issue groups

WARNINGMaintainabilityNon-prefixed global variableGlobal variables defined by a theme/plugin should start with the theme/plugin prefix. Found: "$CAMPAIGN_IDs".214
Category
Maintainability
Occurrences
214
Severity
warning

Sample message

Global variables defined by a theme/plugin should start with the theme/plugin prefix. Found: "$CAMPAIGN_IDs".

ERRORSecurityOutput is not escapedAll output should be run through an escaping function (see the Security sections in the WordPress Developer Handbooks), found '"<p>Contact synced successfully (ID {$contact_id})!</p>"'.148
Category
Security
Occurrences
148
Severity
error

Sample message

All output should be run through an escaping function (see the Security sections in the WordPress Developer Handbooks), found '"<p>Contact synced successfully (ID {$contact_id})!</p>"'.

WARNINGSecurityMissing nonce verificationProcessing form data without nonce verification.81
Category
Security
Occurrences
81
Severity
warning

Sample message

Processing form data without nonce verification.

ERRORI18nText Domain MismatchMismatched text domain. Expected 'wp-subscribe-form' but got "chaty".69
Category
I18n
Occurrences
69
Severity
error

Sample message

Mismatched text domain. Expected 'wp-subscribe-form' but got "chaty".

ERRORI18nMissing Arg DomainMissing $domain parameter in function call to __().68
Category
I18n
Occurrences
68
Severity
error

Sample message

Missing $domain parameter in function call to __().

WARNINGSecurityRequest data is not unslashed$_GET[&#039;download_file&#039;] not unslashed before sanitization. Use wp_unslash() or similar66
Category
Security
Occurrences
66
Severity
warning

Sample message

$_GET[&#039;download_file&#039;] not unslashed before sanitization. Use wp_unslash() or similar

WARNINGSecurityInput is not sanitizedDetected usage of a non-sanitized input variable: $_GET[&#039;download_file&#039;]29
Category
Security
Occurrences
29
Severity
warning

Sample message

Detected usage of a non-sanitized input variable: $_GET[&#039;download_file&#039;]

WARNINGSecurityNonce verification recommendedProcessing form data without nonce verification.28
Category
Security
Occurrences
28
Severity
warning

Sample message

Processing form data without nonce verification.

WARNINGSecurityInput is not validatedDetected usage of a possibly undefined superglobal array index: $_GET[&#039;download_file&#039;]. Check that the array index exists before using it.26
Category
Security
Occurrences
26
Severity
warning

Sample message

Detected usage of a possibly undefined superglobal array index: $_GET[&#039;download_file&#039;]. Check that the array index exists before using it.

ERRORSecurityUnsafe printing functionAll output should be run through an escaping function (like esc_html_e() or esc_attr_e()), found '_e'.18
Category
Security
Occurrences
18
Severity
error

Sample message

All output should be run through an escaping function (like esc_html_e() or esc_attr_e()), found '_e'.

Show 15 more
WARNINGMaintainabilityDirect Query17
Category
Maintainability
Occurrences
17
Severity
warning

Sample message

Use of a direct database call is discouraged.

WARNINGMaintainabilityNo Caching16
Category
Maintainability
Occurrences
16
Severity
warning

Sample message

Direct database call without caching detected. Consider using wp_cache_get() / wp_cache_set() or wp_cache_delete().

ERRORMaintainabilityNon Enqueued Stylesheet13
Category
Maintainability
Occurrences
13
Severity
error

Sample message

Stylesheets must be registered/enqueued via wp_enqueue_style()

ERRORMaintainabilityMissing direct file access protection13
Category
Maintainability
Occurrences
13
Severity
error

Sample message

PHP file should prevent direct access. Add a check like: if ( ! defined( 'ABSPATH' ) ) exit;

ERRORI18nNon Singular String Literal Text12
Category
I18n
Occurrences
12
Severity
error

Sample message

The $text parameter must be a single text string literal. Found: 'Form 10 <a href="'.P_UPGRADE_LINK.'" target="_blank" class="upgrade-sfba">'.P_UPGRADE_VERSION_TEXT.'</a>'

WARNINGSecurityInterpolated SQL is not prepared11
Category
Security
Occurrences
11
Severity
warning

Sample message

Use placeholders and $wpdb-&gt;prepare(); found interpolated variable $email at &quot;SELECT * FROM `$table_name` WHERE `email` = &#039;$email&#039;&quot;

WARNINGMaintainabilityNon-prefixed function10
Category
Maintainability
Occurrences
10
Severity
warning

Sample message

Functions declared in the global namespace by a theme/plugin should start with the theme/plugin prefix. Found: &quot;change_publish_button&quot;.

WARNINGSecurityDatabase parameter is not escaped9
Category
Security
Occurrences
9
Severity
warning

Sample message

Unescaped parameter $sfba_subscription_table used in $wpdb-&gt;get_results()\n$sfba_subscription_table assigned unsafely at line 227.

WARNINGMaintainabilityNon-prefixed constant9
Category
Maintainability
Occurrences
9
Severity
warning

Sample message

Global constants defined by a theme/plugin should start with the theme/plugin prefix. Found: &quot;ACTIVECAMPAIGN_API_KEY&quot;.

ERRORSecuritySQL query is not prepared8
Category
Security
Occurrences
8
Severity
error

Sample message

Use placeholders and $wpdb->prepare(); found $delete_sql

ERRORMaintainabilitywp function not compatible with requires wp8
Category
Maintainability
Occurrences
8
Severity
error

Sample message

Function "is_php_version_compatible()" requires WordPress 5.2.0, but your plugin minimum supported version is WordPress 4.7.0.

ERRORMaintainabilitydate date7
Category
Maintainability
Occurrences
7
Severity
error

Sample message

date() is affected by runtime timezone changes which can cause date/time to be incorrectly displayed. Use gmdate() instead.

ERRORSecuritySetting is missing a sanitization callback6
Category
Security
Occurrences
6
Severity
error

Sample message

Sanitization missing for register_setting().

ERRORMaintainabilitycurl curl setopt6
Category
Maintainability
Occurrences
6
Severity
error

Sample message

Using cURL functions is highly discouraged. Use wp_remote_get() instead.

ERRORSecurityDatabase parameter is not escaped5
Category
Security
Occurrences
5
Severity
error

Sample message

Unescaped parameter $delete_sql used in $wpdb->query()\n$delete_sql assigned unsafely at line 150.

Score History

First score snapshot

v1.6.2

23

Latest

Findings
961
Errors
419
Warnings
542
Check
2.0.0

Related Plugins

Contact Form Query

1k+ active installs

100
Style Contact Form 7

1k+ active installs

100
ACF Field For CF7

10k+ active installs

99
Disable Flamingo Addressbook

4k+ active installs

99