Number one WordPress forum plugin with AI features. Full-fledged forum solution with modern forum design. Community builder WordPress forum plugin.
17
Score
4,048
Errors
2,922
Warnings
+0
Change
Category Scores
Security0
Repo54
Performance91
Maintainability0
Issues to Review
Prioritized issue groups from the latest Plugin Check scan
Security
4,648
11 issue groups
Maintainability
1,889
9 issue groups
I18n
256
3 issue groups
Performance
17
1 issue group
ERRORSecurityUnsafe printing functionAll output should be run through an escaping function (like esc_html_e() or esc_attr_e()), found '_e'.1,658
- Category
- Security
- Occurrences
- 1,658
- Severity
- error
Sample message
All output should be run through an escaping function (like esc_html_e() or esc_attr_e()), found '_e'.
ERRORSecurityOutput is not escapedAll output should be run through an escaping function (see the Security sections in the WordPress Developer Handbooks), found '"$sub' style='float:left'>$name</a>"'.1,627
- Category
- Security
- Occurrences
- 1,627
- Severity
- error
Sample message
All output should be run through an escaping function (see the Security sections in the WordPress Developer Handbooks), found '"$sub' style='float:left'>$name</a>"'.
WARNINGMaintainabilityNon-prefixed global variableGlobal variables defined by a theme/plugin should start with the theme/plugin prefix. Found: "$SQL".1,373
- Category
- Maintainability
- Occurrences
- 1,373
- Severity
- warning
Sample message
Global variables defined by a theme/plugin should start with the theme/plugin prefix. Found: "$SQL".
WARNINGSecurityNonce verification recommendedProcessing form data without nonce verification.318
- Category
- Security
- Occurrences
- 318
- Severity
- warning
Sample message
Processing form data without nonce verification.
WARNINGSecurityMissing nonce verificationProcessing form data without nonce verification.289
- Category
- Security
- Occurrences
- 289
- Severity
- warning
Sample message
Processing form data without nonce verification.
ERRORI18nMissing Translators CommentA function call to __() with texts containing placeholders was found, but was not accompanied by a "translators:" comment on the line above to clarify the meaning of the placeholders.194
- Category
- I18n
- Occurrences
- 194
- Severity
- error
Sample message
A function call to __() with texts containing placeholders was found, but was not accompanied by a "translators:" comment on the line above to clarify the meaning of the placeholders.
ERRORSecuritySQL query is not preparedUse placeholders and $wpdb->prepare(); found $batch_query164
- Category
- Security
- Occurrences
- 164
- Severity
- error
Sample message
Use placeholders and $wpdb->prepare(); found $batch_query
WARNINGSecurityRequest data is not unslashed$_GET['action'] not unslashed before sanitization. Use wp_unslash() or similar164
- Category
- Security
- Occurrences
- 164
- Severity
- warning
Sample message
$_GET['action'] not unslashed before sanitization. Use wp_unslash() or similar
WARNINGSecurityInput is not sanitizedDetected usage of a non-sanitized input variable: $_FILES['add_lang']['error']['xml']152
- Category
- Security
- Occurrences
- 152
- Severity
- warning
Sample message
Detected usage of a non-sanitized input variable: $_FILES['add_lang']['error']['xml']
WARNINGMaintainabilityDirect QueryUse of a direct database call is discouraged.133
- Category
- Maintainability
- Occurrences
- 133
- Severity
- warning
Sample message
Use of a direct database call is discouraged.
Show 15 moreShow less
WARNINGMaintainabilityNo Caching127
- Category
- Maintainability
- Occurrences
- 127
- Severity
- warning
Sample message
Direct database call without caching detected. Consider using wp_cache_get() / wp_cache_set() or wp_cache_delete().
WARNINGSecurityInput is not validated104
- Category
- Security
- Occurrences
- 104
- Severity
- warning
Sample message
Detected usage of a possibly undefined superglobal array index: $_FILES[$argname]['error']. Check that the array index exists before using it.
ERRORMaintainabilitystrip tags strip tags94
- Category
- Maintainability
- Occurrences
- 94
- Severity
- error
Sample message
strip_tags() is discouraged. Use the more comprehensive wp_strip_all_tags() instead.
WARNINGSecurityInterpolated SQL is not prepared76
- Category
- Security
- Occurrences
- 76
- Severity
- warning
Sample message
Use placeholders and $wpdb->prepare(); found interpolated variable $col at "SHOW COLUMNS FROM `$table` LIKE '$col'"
ERRORSecurityDatabase parameter is not escaped62
- Category
- Security
- Occurrences
- 62
- Severity
- error
Sample message
Unescaped parameter $batch_query used in $wpdb->get_results()\n$batch_query assigned unsafely at line 313.
WARNINGMaintainabilityNon-prefixed function49
- Category
- Maintainability
- Occurrences
- 49
- Severity
- warning
Sample message
Functions declared in the global namespace by a theme/plugin should start with the theme/plugin prefix. Found: "WPF".
ERRORMaintainabilitydate date38
- Category
- Maintainability
- Occurrences
- 38
- Severity
- error
Sample message
date() is affected by runtime timezone changes which can cause date/time to be incorrectly displayed. Use gmdate() instead.
WARNINGSecurityDatabase parameter is not escaped34
- Category
- Security
- Occurrences
- 34
- Severity
- warning
Sample message
Unescaped parameter $embeddings_table used in $wpdb->get_var()\n$embeddings_table assigned unsafely at line 3022.
ERRORI18nUnordered Placeholders Text33
- Category
- I18n
- Occurrences
- 33
- Severity
- error
Sample message
Multiple placeholders in translatable strings should be ordered. Expected "%1$d, %2$d", but got "%d, %d" in '%d topic(s) matching your filters have been queued for indexing. %d credit(s) used.'.
ERRORMaintainabilityMissing direct file access protection31
- Category
- Maintainability
- Occurrences
- 31
- Severity
- error
Sample message
PHP file should prevent direct access. Add a check like: if ( ! defined( 'ABSPATH' ) ) exit;
ERRORI18nMissing Arg Domain29
- Category
- I18n
- Occurrences
- 29
- Severity
- error
Sample message
Missing $domain parameter in function call to __().
WARNINGMaintainabilityNon-prefixed hook name26
- Category
- Maintainability
- Occurrences
- 26
- Severity
- warning
Sample message
Hook names invoked by a theme/plugin should start with the theme/plugin prefix. Found: "active_plugins".
ERRORMaintainabilityparse url parse url18
- Category
- Maintainability
- Occurrences
- 18
- Severity
- error
Sample message
parse_url() is discouraged because of inconsistency in the output across PHP versions; use wp_parse_url() instead.
WARNINGPerformancePost Not In exclude17
- Category
- Performance
- Occurrences
- 17
- Severity
- warning
Sample message
Using exclusionary parameters, like exclude, in calls to get_posts() should be done with caution, see https://wpvip.com/documentation/performance-improvements-by-removing-usage-of-post__not_in/ for more information.
ERRORSupply ChainHidden files included17
- Category
- Supply Chain
- Occurrences
- 17
- Severity
- error
Sample message
Hidden files are not permitted.
External Connections
Potential connections found in static code analysis.
Outbound calls
219
External assets
1
Incoming endpoints
80
Notable Domains
wpforo.com40 · outbound
google.com6 · outbound
v3.wpforo.com6 · outbound
gvectors.com5 · outbound
twitter.com4 · outbound
linkedin.com3 · outbound
Platform / Reference Domains
w3.org107 · platform/reference
codex.wordpress.org2 · platform/reference
github.com2 · platform/reference
ps.w.org2 · platform/reference
wordpress.org1 · platform/reference
External Asset Domains
vk.com4 · asset + outbound
Incoming Endpoints
wp_ajax_nopriv_wpforo_ai_get_topic_suggestionspublic
wp_ajax
wp_ajax_nopriv_wpforo_ai_public_searchpublic
wp_ajax
wp_ajax_nopriv_wpforo_ai_semantic_searchpublic
wp_ajax
wp_ajax_nopriv_wpforo_ai_summarize_topicpublic
wp_ajax
wp_ajax_nopriv_wpforo_ai_translatepublic
wp_ajax
wp_ajax_nopriv_wpforo_get_member_templatepublic
wp_ajax
Admin AJAX endpoints70
wp_ajax_wpforo_acp_toggleauthenticated
wp_ajax
wp_ajax_wpforo_ai_actionauthenticated
wp_ajax
wp_ajax_wpforo_ai_activate_licenseauthenticated
wp_ajax
wp_ajax_wpforo_ai_activate_paddle_transactionauthenticated
wp_ajax
wp_ajax_wpforo_ai_add_knowledgeauthenticated
wp_ajax
wp_ajax_wpforo_ai_bot_replyauthenticated
wp_ajax
wp_ajax_wpforo_ai_cancel_cloud_indexingauthenticated
wp_ajax
wp_ajax_wpforo_ai_chat_check_limitauthenticated
wp_ajax
wp_ajax_wpforo_ai_chat_create_conversationauthenticated
wp_ajax
wp_ajax_wpforo_ai_chat_delete_conversationauthenticated
wp_ajax
wp_ajax_wpforo_ai_chat_get_conversationsauthenticated
wp_ajax
wp_ajax_wpforo_ai_chat_get_messagesauthenticated
wp_ajax
58 more hidden
Score History
3 score snapshots
v3.1.4
17
Latest
- Findings
- 6,970
- Errors
- 4,048
- Warnings
- 2,922
- Check
- 2.0.0
v3.1.2
17
Score
- Findings
- 7,087
- Errors
- 4,054
- Warnings
- 3,033
- Check
- 2.0.0
| Scan | Score | Findings | Errors | Warnings | Plugin | Check |
|---|---|---|---|---|---|---|
| Latest | 17 | 6,970 | 4,048 | 2,922 | v3.1.4 | 2.0.0 |
| 17 | 7,087 | 4,054 | 3,033 | v3.1.2 | 2.0.0 |
Relationship Map
Author, categories, issues, domains, and nearby plugins.
Loading map
PluginAuthorCategoryIssueDomainRelated
Relationship links
Plugin
Author
Issue
Unsafe printing function1,658 findingsOutput is not escaped1,627 findingsNon-prefixed global variable1,373 findingsNonce verification recommended318 findingsMissing nonce verification289 findingsMissing Translators Comment194 findingsSQL query is not prepared164 findingsRequest data is not unslashed164 findings
Domain
Related
Ultimate Member – reCAPTCHA98 scoreClassic Editor63 scoreWooCommerce21 scoreYoast SEO – Advanced SEO with real-time guidance and built-in AI24 scoreWordfence Security – Firewall, Malware Scan, and Login Security21 scoreAkismet Anti-spam: Spam Protection35 scoreAll-in-One WP Migration and Backup34 scoreSite Kit by Google – Analytics, Search Console, AdSense, Speed25 scoreDuplicate Page40 scoreReally Simple Security – Simple and Performant Security (formerly Really Simple SSL)19 scoreWordPress Importer25 scoreUltimate Member – User Profile, Registration, Login, Member Directory, Content Restriction & Membership Plugin24 scorebbPress21 scoreOne User Avatar | User Profile Picture34 score
Plugin
Author
Issue
Unsafe printing function1,658 findingsOutput is not escaped1,627 findingsNon-prefixed global variable1,373 findingsNonce verification recommended318 findingsMissing nonce verification289 findingsMissing Translators Comment194 findingsSQL query is not prepared164 findingsRequest data is not unslashed164 findings
Domain
Related
Ultimate Member – reCAPTCHA98 scoreClassic Editor63 scoreWooCommerce21 scoreYoast SEO – Advanced SEO with real-time guidance and built-in AI24 scoreWordfence Security – Firewall, Malware Scan, and Login Security21 scoreAkismet Anti-spam: Spam Protection35 scoreAll-in-One WP Migration and Backup34 scoreSite Kit by Google – Analytics, Search Console, AdSense, Speed25 scoreDuplicate Page40 scoreReally Simple Security – Simple and Performant Security (formerly Really Simple SSL)19 scoreWordPress Importer25 scoreUltimate Member – User Profile, Registration, Login, Member Directory, Content Restriction & Membership Plugin24 scorebbPress21 scoreOne User Avatar | User Profile Picture34 score
Related Plugins
Ultimate Member – reCAPTCHA
20k+ active installs
98
Inline Image Upload for BBPress
3k+ active installs
98
bbPress Enable TinyMCE Visual Tab
600 active installs
87
CBX User Online & Last Login
800 active installs
86
Wbcom Designs – Birthday Widget for BuddyPress
400 active installs
84
ForumWP – Forum & Discussion Board
800 active installs
82