PluginScore

WPO365 | MICROSOFT 365 GRAPH MAILER

Send WordPress emails from a M365 / Exchange Online Mailbox using Microsoft Graph, leveraging OAuth for authentication which is more secure than SMTP

v5.8Marco van WierenUpdated Added 10k+ installs98% rating
emailmicrosoftphpmailersmtpwp_mail
37
Score
112
Errors
83
Warnings
+0
Change

Category Scores

Security0
Repo100
Performance100
Maintainability60

Issues to Review

Prioritized issue groups from the latest Plugin Check scan

195 findings

I18n

81

3 issue groups

Maintainability

72

10 issue groups

Security

42

9 issue groups

ERRORI18nText Domain MismatchMismatched text domain. Expected 'wpo365-msgraphmailer' but got 'wpo365-login'.48
Category
I18n
Occurrences
48
Severity
error

Sample message

Mismatched text domain. Expected 'wpo365-msgraphmailer' but got 'wpo365-login'.

WordPress.WP.I18n.TextDomainMismatchReference
WARNINGMaintainabilityNon-prefixed namespaceNamespaces declared by a theme/plugin should start with the theme/plugin prefix. Found: "Wpo".39
Category
Maintainability
Occurrences
39
Severity
warning

Sample message

Namespaces declared by a theme/plugin should start with the theme/plugin prefix. Found: "Wpo".

WordPress.NamingConventions.PrefixAllGlobals.NonPrefixedNamespaceFound
ERRORI18nMissing Arg DomainMissing $domain parameter in function call to __().25
Category
I18n
Occurrences
25
Severity
error

Sample message

Missing $domain parameter in function call to __().

WordPress.WP.I18n.MissingArgDomainReference
ERRORMaintainabilitywp function not compatible with requires wpFunction "str_contains()" requires WordPress 5.9.0, but your plugin minimum supported version is WordPress 5.0.0.12
Category
Maintainability
Occurrences
12
Severity
error

Sample message

Function "str_contains()" requires WordPress 5.9.0, but your plugin minimum supported version is WordPress 5.0.0.

wp_function_not_compatible_with_requires_wpReference
WARNINGSecurityRequest data is not unslashed$_GET['message'] not unslashed before sanitization. Use wp_unslash() or similar8
Category
Security
Occurrences
8
Severity
warning

Sample message

$_GET['message'] not unslashed before sanitization. Use wp_unslash() or similar

WordPress.Security.ValidatedSanitizedInput.MissingUnslash
ERRORI18nMissing Translators CommentA function call to __() with texts containing placeholders was found, but was not accompanied by a "translators:" comment on the line above to clarify the meaning of the placeholders.8
Category
I18n
Occurrences
8
Severity
error

Sample message

A function call to __() with texts containing placeholders was found, but was not accompanied by a "translators:" comment on the line above to clarify the meaning of the placeholders.

WordPress.WP.I18n.MissingTranslatorsCommentReference
WARNINGSecurityInput is not sanitizedDetected usage of a non-sanitized input variable: $_GET['message']7
Category
Security
Occurrences
7
Severity
warning

Sample message

Detected usage of a non-sanitized input variable: $_GET['message']

WordPress.Security.ValidatedSanitizedInput.InputNotSanitized
WARNINGMaintainabilityNon-prefixed global variableGlobal variables defined by a theme/plugin should start with the theme/plugin prefix. Found: "$WPO_CONFIG".6
Category
Maintainability
Occurrences
6
Severity
warning

Sample message

Global variables defined by a theme/plugin should start with the theme/plugin prefix. Found: "$WPO_CONFIG".

WordPress.NamingConventions.PrefixAllGlobals.NonPrefixedVariableFound
ERRORSecurityUnsafe printing functionAll output should be run through an escaping function (like esc_html_e() or esc_attr_e()), found '_e'.6
Category
Security
Occurrences
6
Severity
error

Sample message

All output should be run through an escaping function (like esc_html_e() or esc_attr_e()), found '_e'.

WordPress.Security.EscapeOutput.UnsafePrintingFunctionReference
WARNINGSecurityNonce verification recommendedProcessing form data without nonce verification.6
Category
Security
Occurrences
6
Severity
warning

Sample message

Processing form data without nonce verification.

WordPress.Security.NonceVerification.Recommended
Show 12 more
WARNINGMaintainabilityNon-prefixed hook name5
Category
Maintainability
Occurrences
5
Severity
warning

Sample message

Hook names invoked by a theme/plugin should start with the theme/plugin prefix. Found: "destroy_wpo365_session".

WordPress.NamingConventions.PrefixAllGlobals.NonPrefixedHooknameFound
ERRORSecurityUnsupported Identifier Placeholder4
Category
Security
Occurrences
4
Severity
error

Sample message

The %i modifier is only supported in WP 6.2 or higher. Found: "%i".

WordPress.DB.PreparedSQLPlaceholders.UnsupportedIdentifierPlaceholder
ERRORSecurityOutput is not escaped4
Category
Security
Occurrences
4
Severity
error

Sample message

All output should be run through an escaping function (see the Security sections in the WordPress Developer Handbooks), found '$_SERVER['REQUEST_URI']'.

WordPress.Security.EscapeOutput.OutputNotEscapedReference
WARNINGSecurityMissing nonce verification4
Category
Security
Occurrences
4
Severity
warning

Sample message

Processing form data without nonce verification.

WordPress.Security.NonceVerification.Missing
WARNINGMaintainabilitytrademarked term3
Category
Maintainability
Occurrences
3
Severity
warning

Sample message

The plugin name includes a restricted term. Your chosen plugin name - "WPO365 | MICROSOFT 365 GRAPH MAILER" - contains the restricted term "wp" which cannot be used at all in your plugin name.

trademarked_term
ERRORMaintainabilityOffloaded Content2
Category
Maintainability
Occurrences
2
Severity
error

Sample message

Offloading images, js, css, and other scripts to your servers or any remote service is disallowed.

PluginCheck.CodeAnalysis.Offloading.OffloadedContent
WARNINGSecuritywp redirect wp redirect2
Category
Security
Occurrences
2
Severity
warning

Sample message

wp_redirect() found. Using wp_safe_redirect(), along with the "allowed_redirect_hosts" filter if needed, can help avoid any chances of malicious redirects within code. It is also important to remember to call exit() after a redirect so that no other unwanted code is executed.

WordPress.Security.SafeRedirect.wp_redirect_wp_redirectReference
WARNINGMaintainabilityupdate modification detected2
Category
Maintainability
Occurrences
2
Severity
warning

Sample message

Plugin Updater detected. Detected code which may be altering WordPress update routines. Detected: _site_transient_update_plugins

update_modification_detectedReference
WARNINGSecurityInput is not validated1
Category
Security
Occurrences
1
Severity
warning

Sample message

Detected usage of a possibly undefined superglobal array index: $_SERVER['REQUEST_URI']. Check that the array index exists before using it.

WordPress.Security.ValidatedSanitizedInput.InputNotValidated
ERRORMaintainabilityfive star reviews detected1
Category
Maintainability
Occurrences
1
Severity
error

Sample message

Linking directly to 5 stars reviews is not allowed.

five_star_reviews_detectedReference
ERRORMaintainabilityMissing direct file access protection1
Category
Maintainability
Occurrences
1
Severity
error

Sample message

PHP file should prevent direct access. Add a check like: if ( ! defined( 'ABSPATH' ) ) exit;

missing_direct_file_access_protectionReference
ERRORMaintainabilityplugin updater detected1
Category
Maintainability
Occurrences
1
Severity
error

Sample message

Plugin Updater detected. These are not permitted in WordPress.org hosted plugins. Detected: site_transient_update_plugins

plugin_updater_detected

External Connections

Potential connections found in static code analysis.

31 domains

Outbound calls

297

External assets

3

Incoming endpoints

0

Notable Domains

phpseclib.sourceforge.net32 · outbound
tools.ietf.org19 · outbound
docs.wpo365.com13 · outbound
en.wikipedia.org13 · outbound
graph.microsoft.com12 · outbound
php.net6 · outbound

Platform / Reference Domains

opensource.org30 · platform/reference
github.com8 · platform/reference
wordpress.org3 · platform/reference

External Asset Domains

wpo365.com126 · asset + outbound

Incoming Endpoints

No public endpoints detected.

Score History

3 score snapshots

+0
1007550250Jun 20, 2026, 02:10 PM UTC Score 37/100 Plugin v5.6 Plugin Check 2.0.0 112 errors, 83 warningsJun 23, 2026, 01:38 PM UTC Score 37/100 Plugin v5.7 Plugin Check 2.0.0 112 errors, 83 warningsJun 25, 2026, 11:18 AM UTC Score 37/100 Plugin v5.8 Plugin Check 2.0.0 112 errors, 83 warningsJun 20, 2026Jun 25, 2026

v5.8

37

Latest

Findings
195
Errors
112
Warnings
83
Check
2.0.0

v5.7

37

Score

Findings
195
Errors
112
Warnings
83
Check
2.0.0

Relationship Map

Author, categories, issues, domains, and nearby plugins.

37 nodes

Related

Yoast SEO – Advanced SEO with real-time guidance and built-in AI24 scoreLiteSpeed Cache35 scoreSite Kit by Google – Analytics, Search Console, AdSense, Speed25 scoreWordfence Security – Firewall, Malware Scan, and Login Security21 scoreJetpack – WP Security, Backup, Speed, & Growth23 scoreReally Simple Security – Simple and Performant Security (formerly Really Simple SSL)19 scoreAdvanced Custom Fields (ACF®)23 scoreUltimate Addons for Elementor33 scoreWordPress Importer25 scoreStarter Templates – AI-Powered Templates for Elementor & Gutenberg24 scoreSmash Balloon Social Photo Feed – Easy Social Feeds Plugin25 scoreSpectra Gutenberg Blocks – Website Builder for the Block Editor25 scoreWP Mail SMTP by WPForms – The Most Popular SMTP and Email Log Plugin30 scoreMC4WP: Mailchimp for WordPress57 score

Related Plugins

Block for Mailchimp – Add Email Subscription Forms and Collect Leads

2k+ active installs

100
Contact Form Query

1k+ active installs

100
miniOrange Embed Files for SharePoint/OneDrive

800 active installs

100
Configure SMTP

6k+ active installs

99
Email Address Obfuscation

2k+ active installs

99
ICS Calendar

10k+ active installs

99