WordPress + Microsoft Entra | Ext. ID | B2C | M365 Integration for your Digital Workplace. For SSO, Mail, Roles, Access, Sync, SharePoint, PowerBI.
28
Score
209
Errors
217
Warnings
+0
Change
Category Scores
Security0
Repo100
Performance100
Maintainability13
Issues to Review
Prioritized issue groups from the latest Plugin Check scan
Security
200
10 issue groups
Maintainability
178
13 issue groups
I18n
33
2 issue groups
ERRORSecurityException output is not escapedAll output should be run through an escaping function (see the Security sections in the WordPress Developer Handbooks), found '"Cannot validate digest: Unsupported Algorithm <$digestAlgorithm>"'.90
- Category
- Security
- Occurrences
- 90
- Severity
- error
Sample message
All output should be run through an escaping function (see the Security sections in the WordPress Developer Handbooks), found '"Cannot validate digest: Unsupported Algorithm <$digestAlgorithm>"'.
WARNINGMaintainabilityNon-prefixed namespaceNamespaces declared by a theme/plugin should start with the theme/plugin prefix. Found: "Wpo".75
- Category
- Maintainability
- Occurrences
- 75
- Severity
- warning
Sample message
Namespaces declared by a theme/plugin should start with the theme/plugin prefix. Found: "Wpo".
WARNINGMaintainabilityNon-prefixed global variableGlobal variables defined by a theme/plugin should start with the theme/plugin prefix. Found: "$WPO_CONFIG".30
- Category
- Maintainability
- Occurrences
- 30
- Severity
- warning
Sample message
Global variables defined by a theme/plugin should start with the theme/plugin prefix. Found: "$WPO_CONFIG".
WARNINGSecurityRequest data is not unslashed$_GET['RelayState'] not unslashed before sanitization. Use wp_unslash() or similar27
- Category
- Security
- Occurrences
- 27
- Severity
- warning
Sample message
$_GET['RelayState'] not unslashed before sanitization. Use wp_unslash() or similar
WARNINGSecurityInput is not sanitizedDetected usage of a non-sanitized input variable: $_GET['RelayState']26
- Category
- Security
- Occurrences
- 26
- Severity
- warning
Sample message
Detected usage of a non-sanitized input variable: $_GET['RelayState']
ERRORI18nMissing Arg DomainMissing $domain parameter in function call to __().25
- Category
- I18n
- Occurrences
- 25
- Severity
- error
Sample message
Missing $domain parameter in function call to __().
WARNINGSecurityNonce verification recommendedProcessing form data without nonce verification.20
- Category
- Security
- Occurrences
- 20
- Severity
- warning
Sample message
Processing form data without nonce verification.
ERRORMaintainabilityNot AllowedUse of heredoc syntax (<<<) is not allowed; use standard strings or inline HTML instead18
- Category
- Maintainability
- Occurrences
- 18
- Severity
- error
Sample message
Use of heredoc syntax (<<<) is not allowed; use standard strings or inline HTML instead
ERRORMaintainabilitywp function not compatible with requires wpFunction "str_contains()" requires WordPress 5.9.0, but your plugin minimum supported version is WordPress 5.0.0.17
- Category
- Maintainability
- Occurrences
- 17
- Severity
- error
Sample message
Function "str_contains()" requires WordPress 5.9.0, but your plugin minimum supported version is WordPress 5.0.0.
ERRORSecurityOutput is not escapedAll output should be run through an escaping function (see the Security sections in the WordPress Developer Handbooks), found '$_SERVER['REQUEST_URI']'.10
- Category
- Security
- Occurrences
- 10
- Severity
- error
Sample message
All output should be run through an escaping function (see the Security sections in the WordPress Developer Handbooks), found '$_SERVER['REQUEST_URI']'.
Show 15 moreShow less
ERRORMaintainabilitycurl curl setopt8
- Category
- Maintainability
- Occurrences
- 8
- Severity
- error
Sample message
Using cURL functions is highly discouraged. Use wp_remote_get() instead.
ERRORI18nMissing Translators Comment8
- Category
- I18n
- Occurrences
- 8
- Severity
- error
Sample message
A function call to __() with texts containing placeholders was found, but was not accompanied by a "translators:" comment on the line above to clarify the meaning of the placeholders.
ERRORSecurityUnsupported Identifier Placeholder7
- Category
- Security
- Occurrences
- 7
- Severity
- error
Sample message
The %i modifier is only supported in WP 6.2 or higher. Found: "%i".
WARNINGMaintainabilityerror log var export6
- Category
- Maintainability
- Occurrences
- 6
- Severity
- warning
Sample message
var_export() found. Debug code should not normally be used in production.
ERRORSecurityUnsafe printing function6
- Category
- Security
- Occurrences
- 6
- Severity
- error
Sample message
All output should be run through an escaping function (like esc_html_e() or esc_attr_e()), found '_e'.
WARNINGSecurityMissing nonce verification6
- Category
- Security
- Occurrences
- 6
- Severity
- warning
Sample message
Processing form data without nonce verification.
WARNINGMaintainabilityNon-prefixed hook name5
- Category
- Maintainability
- Occurrences
- 5
- Severity
- warning
Sample message
Hook names invoked by a theme/plugin should start with the theme/plugin prefix. Found: "destroy_wpo365_session".
WARNINGSecurityInput is not validated5
- Category
- Security
- Occurrences
- 5
- Severity
- warning
Sample message
Detected usage of a possibly undefined superglobal array index: $_SERVER['QUERY_STRING']. Check that the array index exists before using it.
WARNINGMaintainabilityprevent path disclosure error reporting4
- Category
- Maintainability
- Occurrences
- 4
- Severity
- warning
Sample message
error_reporting() can lead to full path disclosure.
ERRORMaintainabilityMissing direct file access protection4
- Category
- Maintainability
- Occurrences
- 4
- Severity
- error
Sample message
PHP file should prevent direct access. Add a check like: if ( ! defined( 'ABSPATH' ) ) exit;
WARNINGMaintainabilityNon-prefixed class3
- Category
- Maintainability
- Occurrences
- 3
- Severity
- warning
Sample message
Classes declared by a theme/plugin should start with the theme/plugin prefix. Found: "XMLSecEnc".
WARNINGSecuritywp redirect wp redirect3
- Category
- Security
- Occurrences
- 3
- Severity
- warning
Sample message
wp_redirect() found. Using wp_safe_redirect(), along with the "allowed_redirect_hosts" filter if needed, can help avoid any chances of malicious redirects within code. It is also important to remember to call exit() after a redirect so that no other unwanted code is executed.
ERRORMaintainabilityrand mt rand3
- Category
- Maintainability
- Occurrences
- 3
- Severity
- error
Sample message
mt_rand() is discouraged. Use the far less predictable wp_rand() instead.
WARNINGMaintainabilitytrademarked term3
- Category
- Maintainability
- Occurrences
- 3
- Severity
- warning
Sample message
The plugin name includes a restricted term. Your chosen plugin name - "WPO365 | LOGIN" - contains the restricted term "wp" which cannot be used at all in your plugin name.
ERRORMaintainabilityOffloaded Content2
- Category
- Maintainability
- Occurrences
- 2
- Severity
- error
Sample message
Offloading images, js, css, and other scripts to your servers or any remote service is disallowed.
External Connections
Potential connections found in static code analysis.
Outbound calls
262
External assets
2
Incoming endpoints
36
Notable Domains
graph.microsoft.com17 · outbound
docs.wpo365.com14 · outbound
tutorials.wpo365.com4 · outbound
login.microsoftonline.com3 · outbound
analysis.windows.net2 · outbound
cdnjs.cloudflare.com2 · outbound
Platform / Reference Domains
w3.org79 · platform/reference
wordpress.org3 · platform/reference
github.com2 · platform/reference
opensource.org2 · platform/reference
External Asset Domains
wpo365.com122 · asset + outbound
fonts.googleapis.com1 · asset
Incoming Endpoints
No public endpoints detected.
Admin AJAX endpoints36
admin_post_wpo365_force_check_for_plugin_updatesauthenticated
admin_post
wp_ajax_cors_proxyauthenticated
wp_ajax
wp_ajax_get_tokencacheauthenticated
wp_ajax
wp_ajax_wpo365_block_direct_media_accessauthenticated
wp_ajax
wp_ajax_wpo365_copy_main_site_optionsauthenticated
wp_ajax
wp_ajax_wpo365_delete_settingsauthenticated
wp_ajax
wp_ajax_wpo365_delete_tokensauthenticated
wp_ajax
wp_ajax_wpo365_dismiss_wpo_health_messagesauthenticated
wp_ajax
wp_ajax_wpo365_export_sp_metaauthenticated
wp_ajax
wp_ajax_wpo365_generate_scim_secret_tokenauthenticated
wp_ajax
wp_ajax_wpo365_get_insightsauthenticated
wp_ajax
wp_ajax_wpo365_get_insights_summaryauthenticated
wp_ajax
24 more hidden
Score History
7 score snapshots
v43.4
28
Latest
- Findings
- 426
- Errors
- 209
- Warnings
- 217
- Check
- 2.0.0
v43.3
28
Score
- Findings
- 426
- Errors
- 209
- Warnings
- 217
- Check
- 2.0.0
| Scan | Score | Findings | Errors | Warnings | Plugin | Check |
|---|---|---|---|---|---|---|
| Latest | 28 | 426 | 209 | 217 | v43.4 | 2.0.0 |
| 28 | 426 | 209 | 217 | v43.3 | 2.0.0 |
Relationship Map
Author, categories, issues, domains, and nearby plugins.
Loading map
PluginAuthorCategoryIssueDomainRelated
Relationship links
Author
Issue
Domain
Related
WP Mail SMTP by WPForms – The Most Popular SMTP and Email Log Plugin30 scoreYoast SEO – Advanced SEO with real-time guidance and built-in AI24 scoreWooCommerce22 scoreSite Kit by Google – Analytics, Search Console, AdSense, Speed25 scoreWordfence Security – Firewall, Malware Scan, and Login Security21 scoreJetpack – WP Security, Backup, Speed, & Growth22 scoreAdvanced Custom Fields (ACF®)23 scoreUltimate Addons for Elementor33 scoreWordPress Importer25 scoreStarter Templates – AI-Powered Templates for Elementor & Gutenberg24 scoreSmash Balloon Social Photo Feed – Easy Social Feeds Plugin25 scoreSpectra Legacy – Gutenberg Blocks25 scoreMC4WP: Mailchimp for WordPress57 scoreEasy WP SMTP – WordPress SMTP and Email Logs: Gmail SMTP, Office 365, Outlook, Custom SMTP, and more15 score
Author
Issue
Domain
Related
WP Mail SMTP by WPForms – The Most Popular SMTP and Email Log Plugin30 scoreYoast SEO – Advanced SEO with real-time guidance and built-in AI24 scoreWooCommerce22 scoreSite Kit by Google – Analytics, Search Console, AdSense, Speed25 scoreWordfence Security – Firewall, Malware Scan, and Login Security21 scoreJetpack – WP Security, Backup, Speed, & Growth22 scoreAdvanced Custom Fields (ACF®)23 scoreUltimate Addons for Elementor33 scoreWordPress Importer25 scoreStarter Templates – AI-Powered Templates for Elementor & Gutenberg24 scoreSmash Balloon Social Photo Feed – Easy Social Feeds Plugin25 scoreSpectra Legacy – Gutenberg Blocks25 scoreMC4WP: Mailchimp for WordPress57 scoreEasy WP SMTP – WordPress SMTP and Email Logs: Gmail SMTP, Office 365, Outlook, Custom SMTP, and more15 score
Related Plugins
Block for Mailchimp – grow your email list with signup forms
2k+ active installs
100
Contact Form Query
1k+ active installs
100
miniOrange Embed Files for SharePoint/OneDrive
800 active installs
100
ICS Calendar
10k+ active installs
99
Stop WP Emails Going to Spam
10k+ active installs
99
Configure SMTP
6k+ active installs
99