Send WordPress emails from a M365 / Exchange Online Mailbox using Microsoft Graph, leveraging OAuth for authentication which is more secure than SMTP
37
Score
112
Errors
83
Warnings
+0
Change
Category Scores
Security0
Repo100
Performance100
Maintainability60
Issues to Review
Prioritized issue groups from the latest Plugin Check scan
I18n
81
3 issue groups
Maintainability
72
10 issue groups
Security
42
9 issue groups
ERRORI18nText Domain MismatchMismatched text domain. Expected 'wpo365-msgraphmailer' but got 'wpo365-login'.48
- Category
- I18n
- Occurrences
- 48
- Severity
- error
Sample message
Mismatched text domain. Expected 'wpo365-msgraphmailer' but got 'wpo365-login'.
WARNINGMaintainabilityNon-prefixed namespaceNamespaces declared by a theme/plugin should start with the theme/plugin prefix. Found: "Wpo".39
- Category
- Maintainability
- Occurrences
- 39
- Severity
- warning
Sample message
Namespaces declared by a theme/plugin should start with the theme/plugin prefix. Found: "Wpo".
ERRORI18nMissing Arg DomainMissing $domain parameter in function call to __().25
- Category
- I18n
- Occurrences
- 25
- Severity
- error
Sample message
Missing $domain parameter in function call to __().
ERRORMaintainabilitywp function not compatible with requires wpFunction "str_contains()" requires WordPress 5.9.0, but your plugin minimum supported version is WordPress 5.0.0.12
- Category
- Maintainability
- Occurrences
- 12
- Severity
- error
Sample message
Function "str_contains()" requires WordPress 5.9.0, but your plugin minimum supported version is WordPress 5.0.0.
WARNINGSecurityRequest data is not unslashed$_GET['message'] not unslashed before sanitization. Use wp_unslash() or similar8
- Category
- Security
- Occurrences
- 8
- Severity
- warning
Sample message
$_GET['message'] not unslashed before sanitization. Use wp_unslash() or similar
ERRORI18nMissing Translators CommentA function call to __() with texts containing placeholders was found, but was not accompanied by a "translators:" comment on the line above to clarify the meaning of the placeholders.8
- Category
- I18n
- Occurrences
- 8
- Severity
- error
Sample message
A function call to __() with texts containing placeholders was found, but was not accompanied by a "translators:" comment on the line above to clarify the meaning of the placeholders.
WARNINGSecurityInput is not sanitizedDetected usage of a non-sanitized input variable: $_GET['message']7
- Category
- Security
- Occurrences
- 7
- Severity
- warning
Sample message
Detected usage of a non-sanitized input variable: $_GET['message']
WARNINGMaintainabilityNon-prefixed global variableGlobal variables defined by a theme/plugin should start with the theme/plugin prefix. Found: "$WPO_CONFIG".6
- Category
- Maintainability
- Occurrences
- 6
- Severity
- warning
Sample message
Global variables defined by a theme/plugin should start with the theme/plugin prefix. Found: "$WPO_CONFIG".
ERRORSecurityUnsafe printing functionAll output should be run through an escaping function (like esc_html_e() or esc_attr_e()), found '_e'.6
- Category
- Security
- Occurrences
- 6
- Severity
- error
Sample message
All output should be run through an escaping function (like esc_html_e() or esc_attr_e()), found '_e'.
WARNINGSecurityNonce verification recommendedProcessing form data without nonce verification.6
- Category
- Security
- Occurrences
- 6
- Severity
- warning
Sample message
Processing form data without nonce verification.
Show 12 moreShow less
WARNINGMaintainabilityNon-prefixed hook name5
- Category
- Maintainability
- Occurrences
- 5
- Severity
- warning
Sample message
Hook names invoked by a theme/plugin should start with the theme/plugin prefix. Found: "destroy_wpo365_session".
ERRORSecurityUnsupported Identifier Placeholder4
- Category
- Security
- Occurrences
- 4
- Severity
- error
Sample message
The %i modifier is only supported in WP 6.2 or higher. Found: "%i".
ERRORSecurityOutput is not escaped4
- Category
- Security
- Occurrences
- 4
- Severity
- error
Sample message
All output should be run through an escaping function (see the Security sections in the WordPress Developer Handbooks), found '$_SERVER['REQUEST_URI']'.
WARNINGSecurityMissing nonce verification4
- Category
- Security
- Occurrences
- 4
- Severity
- warning
Sample message
Processing form data without nonce verification.
WARNINGMaintainabilitytrademarked term3
- Category
- Maintainability
- Occurrences
- 3
- Severity
- warning
Sample message
The plugin name includes a restricted term. Your chosen plugin name - "WPO365 | MICROSOFT 365 GRAPH MAILER" - contains the restricted term "wp" which cannot be used at all in your plugin name.
ERRORMaintainabilityOffloaded Content2
- Category
- Maintainability
- Occurrences
- 2
- Severity
- error
Sample message
Offloading images, js, css, and other scripts to your servers or any remote service is disallowed.
WARNINGSecuritywp redirect wp redirect2
- Category
- Security
- Occurrences
- 2
- Severity
- warning
Sample message
wp_redirect() found. Using wp_safe_redirect(), along with the "allowed_redirect_hosts" filter if needed, can help avoid any chances of malicious redirects within code. It is also important to remember to call exit() after a redirect so that no other unwanted code is executed.
WARNINGMaintainabilityupdate modification detected2
- Category
- Maintainability
- Occurrences
- 2
- Severity
- warning
Sample message
Plugin Updater detected. Detected code which may be altering WordPress update routines. Detected: _site_transient_update_plugins
WARNINGSecurityInput is not validated1
- Category
- Security
- Occurrences
- 1
- Severity
- warning
Sample message
Detected usage of a possibly undefined superglobal array index: $_SERVER['REQUEST_URI']. Check that the array index exists before using it.
ERRORMaintainabilityfive star reviews detected1
- Category
- Maintainability
- Occurrences
- 1
- Severity
- error
Sample message
Linking directly to 5 stars reviews is not allowed.
ERRORMaintainabilityMissing direct file access protection1
- Category
- Maintainability
- Occurrences
- 1
- Severity
- error
Sample message
PHP file should prevent direct access. Add a check like: if ( ! defined( 'ABSPATH' ) ) exit;
ERRORMaintainabilityplugin updater detected1
- Category
- Maintainability
- Occurrences
- 1
- Severity
- error
Sample message
Plugin Updater detected. These are not permitted in WordPress.org hosted plugins. Detected: site_transient_update_plugins
External Connections
Potential connections found in static code analysis.
Outbound calls
297
External assets
3
Incoming endpoints
0
Notable Domains
phpseclib.sourceforge.net32 · outbound
tools.ietf.org19 · outbound
docs.wpo365.com13 · outbound
en.wikipedia.org13 · outbound
graph.microsoft.com12 · outbound
php.net6 · outbound
Platform / Reference Domains
opensource.org30 · platform/reference
github.com8 · platform/reference
wordpress.org3 · platform/reference
External Asset Domains
wpo365.com126 · asset + outbound
Incoming Endpoints
No public endpoints detected.
Score History
5 score snapshots
v5.10
37
Latest
- Findings
- 195
- Errors
- 112
- Warnings
- 83
- Check
- 2.0.0
v5.9
37
Score
- Findings
- 195
- Errors
- 112
- Warnings
- 83
- Check
- 2.0.0
| Scan | Score | Findings | Errors | Warnings | Plugin | Check |
|---|---|---|---|---|---|---|
| Latest | 37 | 195 | 112 | 83 | v5.10 | 2.0.0 |
| 37 | 195 | 112 | 83 | v5.9 | 2.0.0 |
Relationship Map
Author, categories, issues, domains, and nearby plugins.
Loading map
PluginAuthorCategoryIssueDomainRelated
Relationship links
Author
Issue
Domain
Related
Advanced Custom Fields (ACF®)23 scoreYoast SEO – Advanced SEO with real-time guidance and built-in AI24 scoreSite Kit by Google – Analytics, Search Console, AdSense, Speed25 scoreWordfence Security – Firewall, Malware Scan, and Login Security21 scoreJetpack – WP Security, Backup, Speed, & Growth22 scoreReally Simple Security – Simple and Performant Security (formerly Really Simple SSL)19 scoreUltimate Addons for Elementor33 scoreWordPress Importer25 scoreStarter Templates – AI-Powered Templates for Elementor & Gutenberg24 scoreSmash Balloon Social Photo Feed – Easy Social Feeds Plugin25 scoreSpectra Legacy – Gutenberg Blocks25 scoreWP Mail SMTP by WPForms – The Most Popular SMTP and Email Log Plugin30 scoreMC4WP: Mailchimp for WordPress57 scoreFluentSMTP – WP SMTP Plugin with Amazon SES, SendGrid, Mailgun, Postmark, Cloudflare, toSend, Gmail and Any SMTP28 score
Author
Issue
Domain
Related
Advanced Custom Fields (ACF®)23 scoreYoast SEO – Advanced SEO with real-time guidance and built-in AI24 scoreSite Kit by Google – Analytics, Search Console, AdSense, Speed25 scoreWordfence Security – Firewall, Malware Scan, and Login Security21 scoreJetpack – WP Security, Backup, Speed, & Growth22 scoreReally Simple Security – Simple and Performant Security (formerly Really Simple SSL)19 scoreUltimate Addons for Elementor33 scoreWordPress Importer25 scoreStarter Templates – AI-Powered Templates for Elementor & Gutenberg24 scoreSmash Balloon Social Photo Feed – Easy Social Feeds Plugin25 scoreSpectra Legacy – Gutenberg Blocks25 scoreWP Mail SMTP by WPForms – The Most Popular SMTP and Email Log Plugin30 scoreMC4WP: Mailchimp for WordPress57 scoreFluentSMTP – WP SMTP Plugin with Amazon SES, SendGrid, Mailgun, Postmark, Cloudflare, toSend, Gmail and Any SMTP28 score
Related Plugins
Block for Mailchimp – grow your email list with signup forms
2k+ active installs
100
Contact Form Query
1k+ active installs
100
miniOrange Embed Files for SharePoint/OneDrive
800 active installs
100
ICS Calendar
10k+ active installs
99
Stop WP Emails Going to Spam
10k+ active installs
99
Configure SMTP
6k+ active installs
99