PluginScore

One to one user Chat by WPGuppy

WPGuppy is a well thought and clinically designed and developed WordPress chat plugin which has been engineered to fulfill the market needs.

v1.1.6AmentoTech Private LimitedUpdated Added 700 installs84% rating
Real-time chatchatgroup chatuser to user chatvideo chat
31
Score
74
Errors
187
Warnings
+0
Change

Category Scores

Security0
Repo82
Performance98
Maintainability44

Issues to Review

Prioritized issue groups from the latest Plugin Check scan

261 findings

Maintainability

153

12 issue groups

Security

87

10 issue groups

I18n

12

3 issue groups

WARNINGMaintainabilityNon-prefixed global variableGlobal variables defined by a theme/plugin should start with the theme/plugin prefix. Found: "$app_cluster".53
Category
Maintainability
Occurrences
53
Severity
warning

Sample message

Global variables defined by a theme/plugin should start with the theme/plugin prefix. Found: "$app_cluster".

WordPress.NamingConventions.PrefixAllGlobals.NonPrefixedVariableFound
WARNINGMaintainabilityDirect QueryUse of a direct database call is discouraged.22
Category
Maintainability
Occurrences
22
Severity
warning

Sample message

Use of a direct database call is discouraged.

WordPress.DB.DirectDatabaseQuery.DirectQuery
WARNINGSecurityRequest data is not unslashed$_COOKIE['guppy_guest_account'] not unslashed before sanitization. Use wp_unslash() or similar22
Category
Security
Occurrences
22
Severity
warning

Sample message

$_COOKIE['guppy_guest_account'] not unslashed before sanitization. Use wp_unslash() or similar

WordPress.Security.ValidatedSanitizedInput.MissingUnslash
WARNINGMaintainabilityNo CachingDirect database call without caching detected. Consider using wp_cache_get() / wp_cache_set() or wp_cache_delete().21
Category
Maintainability
Occurrences
21
Severity
warning

Sample message

Direct database call without caching detected. Consider using wp_cache_get() / wp_cache_set() or wp_cache_delete().

WordPress.DB.DirectDatabaseQuery.NoCaching
ERRORMaintainabilitydate datedate() is affected by runtime timezone changes which can cause date/time to be incorrectly displayed. Use gmdate() instead.19
Category
Maintainability
Occurrences
19
Severity
error

Sample message

date() is affected by runtime timezone changes which can cause date/time to be incorrectly displayed. Use gmdate() instead.

WordPress.DateTime.RestrictedFunctions.date_date
WARNINGSecurityInput is not sanitizedDetected usage of a non-sanitized input variable: $_COOKIE['guppy_guest_account']16
Category
Security
Occurrences
16
Severity
warning

Sample message

Detected usage of a non-sanitized input variable: $_COOKIE['guppy_guest_account']

WordPress.Security.ValidatedSanitizedInput.InputNotSanitized
ERRORSecuritySQL query is not preparedUse placeholders and $wpdb->prepare(); found $maxMessageIds12
Category
Security
Occurrences
12
Severity
error

Sample message

Use placeholders and $wpdb->prepare(); found $maxMessageIds

WordPress.DB.PreparedSQL.NotPrepared
ERRORMaintainabilityMissing direct file access protectionPHP file should prevent direct access. Add a check like: if ( ! defined( 'ABSPATH' ) ) exit;12
Category
Maintainability
Occurrences
12
Severity
error

Sample message

PHP file should prevent direct access. Add a check like: if ( ! defined( 'ABSPATH' ) ) exit;

missing_direct_file_access_protectionReference
ERRORSecurityDatabase parameter is not escapedUnescaped parameter $maxMessageIds used in $wpdb->get_results()\n$maxMessageIds assigned unsafely at line 331.11
Category
Security
Occurrences
11
Severity
error

Sample message

Unescaped parameter $maxMessageIds used in $wpdb->get_results()\n$maxMessageIds assigned unsafely at line 331.

PluginCheck.Security.DirectDB.UnescapedDBParameter
WARNINGMaintainabilityNon-prefixed functionFunctions declared in the global namespace by a theme/plugin should start with the theme/plugin prefix. Found: "activate_wp_guppy_lite".9
Category
Maintainability
Occurrences
9
Severity
warning

Sample message

Functions declared in the global namespace by a theme/plugin should start with the theme/plugin prefix. Found: "activate_wp_guppy_lite".

WordPress.NamingConventions.PrefixAllGlobals.NonPrefixedFunctionFound
Show 15 more
WARNINGSecurityDatabase parameter is not escaped6
Category
Security
Occurrences
6
Severity
warning

Sample message

Unescaped parameter $wpguppy_chat_action used in $wpdb->get_var()\n$wpguppy_chat_action assigned unsafely at line 36.

PluginCheck.Security.DirectDB.UnescapedDBParameter
WARNINGMaintainabilitySchema Change6
Category
Maintainability
Occurrences
6
Severity
warning

Sample message

Attempting a database schema change is discouraged.

WordPress.DB.DirectDatabaseQuery.SchemaChange
WARNINGSecurityInterpolated SQL is not prepared6
Category
Security
Occurrences
6
Severity
warning

Sample message

Use placeholders and $wpdb->prepare(); found interpolated variable $wpguppy_chat_action at "SHOW TABLES LIKE '$wpguppy_chat_action'"

WordPress.DB.PreparedSQL.InterpolatedNotPrepared
ERRORI18nNon Singular String Literal Text6
Category
I18n
Occurrences
6
Severity
error

Sample message

The $text parameter must be a single text string literal. Found: $default_translations['blocked']

WordPress.WP.I18n.NonSingularStringLiteralTextReference
WARNINGSecurityMissing nonce verification5
Category
Security
Occurrences
5
Severity
warning

Sample message

Processing form data without nonce verification.

WordPress.Security.NonceVerification.Missing
ERRORI18nText Domain Mismatch5
Category
I18n
Occurrences
5
Severity
error

Sample message

Mismatched text domain. Expected 'wpguppy-lite' but got 'wp-guppy'.

WordPress.WP.I18n.TextDomainMismatchReference
WARNINGMaintainabilityslow db query meta query4
Category
Maintainability
Occurrences
4
Severity
warning

Sample message

Detected usage of meta_query, possible slow query.

WordPress.DB.SlowDBQuery.slow_db_query_meta_query
ERRORSecurityOutput is not escaped4
Category
Security
Occurrences
4
Severity
error

Sample message

All output should be run through an escaping function (see the Security sections in the WordPress Developer Handbooks), found '$args'.

WordPress.Security.EscapeOutput.OutputNotEscapedReference
WARNINGSecurityInput is not validated3
Category
Security
Occurrences
3
Severity
warning

Sample message

Detected usage of a possibly undefined superglobal array index: $_GET['page']. Check that the array index exists before using it.

WordPress.Security.ValidatedSanitizedInput.InputNotValidated
WARNINGMaintainabilitytrademarked term3
Category
Maintainability
Occurrences
3
Severity
warning

Sample message

The plugin name includes a restricted term. Your chosen plugin name - "One to one user Chat by WPGuppy" - contains the restricted term "wp" which cannot be used at all in your plugin name.

trademarked_term
WARNINGMaintainabilityNon-prefixed hook name2
Category
Maintainability
Occurrences
2
Severity
warning

Sample message

Hook names invoked by a theme/plugin should start with the theme/plugin prefix. Found: "guppy_time_slots".

WordPress.NamingConventions.PrefixAllGlobals.NonPrefixedHooknameFound
WARNINGSecurityNonce verification recommended2
Category
Security
Occurrences
2
Severity
warning

Sample message

Processing form data without nonce verification.

WordPress.Security.NonceVerification.Recommended
ERRORMaintainabilityForbidden PHP function found1
Category
Maintainability
Occurrences
1
Severity
error

Sample message

The use of function move_uploaded_file() is forbidden

Generic.PHP.ForbiddenFunctions.Found
WARNINGI18nDiscouraged text-domain loading1
Category
I18n
Occurrences
1
Severity
warning

Sample message

load_plugin_textdomain() has been discouraged since WordPress version 4.6. When your plugin is hosted on WordPress.org, you no longer need to manually include this function call for translations under your plugin slug. WordPress will automatically load the translations for you as needed.

PluginCheck.CodeAnalysis.DiscouragedFunctions.load_plugin_textdomainFoundReference
WARNINGMaintainabilityslow db query meta key1
Category
Maintainability
Occurrences
1
Severity
warning

Sample message

Detected usage of meta_key, possible slow query.

WordPress.DB.SlowDBQuery.slow_db_query_meta_key

External Connections

Potential connections found in static code analysis.

23 domains

Outbound calls

66

External assets

3

Incoming endpoints

3

Notable Domains

wp-guppy.com11 · outbound
themeforest.net10 · outbound
php-fig.org4 · outbound
php.net4 · outbound
pusher.com3 · outbound
craftpip.github.io2 · outbound

Platform / Reference Domains

github.com14 · platform/reference
opensource.org2 · platform/reference
gnu.org1 · platform/reference
w3.org1 · platform/reference

External Asset Domains

fonts.googleapis.com3 · asset

Incoming Endpoints

No public endpoints detected.

Admin AJAX endpoints3
wp_ajax_get_wpguppy_whatsapp_user_infoauthenticated

wp_ajax

wp_ajax_wpguppy_update_guppy_admin_statusauthenticated

wp_ajax

wp_ajax_wpguppy_update_whatsapp_infoauthenticated

wp_ajax

Score History

First score snapshot

v1.1.6

31

Latest

Findings
261
Errors
74
Warnings
187
Check
2.0.0

Relationship Map

Author, categories, issues, domains, and nearby plugins.

37 nodes

Related Plugins

Floating Chat Buttons – Click to Call or Chat, Email

1k+ active installs

94
WP Click to Chat – Email, Live Chat, Call & Book Now Buttons

1k+ active installs

94
Chat Widget: Floating Customer Support Button for 30+ Channels, Supporting SMS, Calls, and Chat – Bit Assist

10k+ active installs

93
Blazeo

400 active installs

92
Simple Chat Button

40k+ active installs

91
Yivic Easy Live Chat

1k+ active installs

91