Beta: An AI agent that builds & edits WordPress sites by chat. Requires a block (FSE) theme - does NOT work with classic themes.
37
Score
23
Errors
87
Warnings
+0
Change
Category Scores
Security0
Repo100
Performance94
Maintainability62
Issues to Review
Prioritized issue groups from the latest Plugin Check scan
Security
56
9 issue groups
Maintainability
50
15 issue groups
Performance
2
1 issue group
WARNINGSecurityNonce verification recommendedProcessing form data without nonce verification.19
- Category
- Security
- Occurrences
- 19
- Severity
- warning
Sample message
Processing form data without nonce verification.
WARNINGMaintainabilityNon-prefixed hook nameHook names invoked by a theme/plugin should start with the theme/plugin prefix. Found: "zip_ai_allow_rest_request".17
- Category
- Maintainability
- Occurrences
- 17
- Severity
- warning
Sample message
Hook names invoked by a theme/plugin should start with the theme/plugin prefix. Found: "zip_ai_allow_rest_request".
WARNINGSecurityDatabase parameter is not escapedUnescaped parameter $batch_sql used in $wpdb->get_results()\n$batch_sql assigned unsafely at line 228.10
- Category
- Security
- Occurrences
- 10
- Severity
- warning
Sample message
Unescaped parameter $batch_sql used in $wpdb->get_results()\n$batch_sql assigned unsafely at line 228.
WARNINGSecurityInterpolated SQL is not preparedUse placeholders and $wpdb->prepare(); found interpolated variable {$placeholders} at "SELECT `{$safe_pk}` AS pk, `{$safe_column}` AS val FROM `{$safe_table}` WHERE `{$safe_pk}` IN ({$placeholders})"10
- Category
- Security
- Occurrences
- 10
- Severity
- warning
Sample message
Use placeholders and $wpdb->prepare(); found interpolated variable {$placeholders} at "SELECT `{$safe_pk}` AS pk, `{$safe_column}` AS val FROM `{$safe_table}` WHERE `{$safe_pk}` IN ({$placeholders})"
WARNINGSecurityRequest data is not unslashed$_GET['state'] not unslashed before sanitization. Use wp_unslash() or similar9
- Category
- Security
- Occurrences
- 9
- Severity
- warning
Sample message
$_GET['state'] not unslashed before sanitization. Use wp_unslash() or similar
WARNINGMaintainabilityerror log error logerror_log() found. Debug code should not normally be used in production.7
- Category
- Maintainability
- Occurrences
- 7
- Severity
- warning
Sample message
error_log() found. Debug code should not normally be used in production.
ERRORMaintainabilitywp function not compatible with requires wpFunction "wp_font_dir()" requires WordPress 6.5.0, but your plugin minimum supported version is WordPress 6.4.0.7
- Category
- Maintainability
- Occurrences
- 7
- Severity
- error
Sample message
Function "wp_font_dir()" requires WordPress 6.5.0, but your plugin minimum supported version is WordPress 6.4.0.
ERRORMaintainabilityunlink unlinkunlink() is discouraged. Use wp_delete_file() to delete a file.5
- Category
- Maintainability
- Occurrences
- 5
- Severity
- error
Sample message
unlink() is discouraged. Use wp_delete_file() to delete a file.
WARNINGMaintainabilityNon-prefixed global variableGlobal variables defined by a theme/plugin should start with the theme/plugin prefix. Found: "$vendor_autoload".4
- Category
- Maintainability
- Occurrences
- 4
- Severity
- warning
Sample message
Global variables defined by a theme/plugin should start with the theme/plugin prefix. Found: "$vendor_autoload".
ERRORSecurityOutput is not escapedAll output should be run through an escaping function (see the Security sections in the WordPress Developer Handbooks), found '$canonical_actions'.3
- Category
- Security
- Occurrences
- 3
- Severity
- error
Sample message
All output should be run through an escaping function (see the Security sections in the WordPress Developer Handbooks), found '$canonical_actions'.
Show 15 moreShow less
ERRORSecuritySQL query is not prepared2
- Category
- Security
- Occurrences
- 2
- Severity
- error
Sample message
Use placeholders and $wpdb->prepare(); found $batch_sql
ERRORPerformanceSuppress Filters suppress filters2
- Category
- Performance
- Occurrences
- 2
- Severity
- error
Sample message
Setting `suppress_filters` to `true` is prohibited.
ERRORMaintainabilityForbidden PHP function found1
- Category
- Maintainability
- Occurrences
- 1
- Severity
- error
Sample message
The use of function wp_get_sidebars_widgets() is forbidden
WARNINGSecurityReplacements Wrong Number1
- Category
- Security
- Occurrences
- 1
- Severity
- warning
Sample message
Incorrect number of replacements passed to $wpdb->prepare(). Found 1 replacement parameters, expected 3.
WARNINGSecurityUnfinished Prepare1
- Category
- Security
- Occurrences
- 1
- Severity
- warning
Sample message
Replacement variables found, but no valid placeholders found in the query.
WARNINGMaintainabilityslow db query meta key1
- Category
- Maintainability
- Occurrences
- 1
- Severity
- warning
Sample message
Detected usage of meta_key, possible slow query.
WARNINGMaintainabilityslow db query meta query1
- Category
- Maintainability
- Occurrences
- 1
- Severity
- warning
Sample message
Detected usage of meta_query, possible slow query.
WARNINGMaintainabilityNon-prefixed constant1
- Category
- Maintainability
- Occurrences
- 1
- Severity
- warning
Sample message
Global constants defined by a theme/plugin should start with the theme/plugin prefix. Found: "WP_MCP_AUTOLOAD".
WARNINGMaintainabilityNon-prefixed function1
- Category
- Maintainability
- Occurrences
- 1
- Severity
- warning
Sample message
Functions declared in the global namespace by a theme/plugin should start with the theme/plugin prefix. Found: "zip_ai_delete_option".
WARNINGMaintainabilityerror log trigger error1
- Category
- Maintainability
- Occurrences
- 1
- Severity
- warning
Sample message
trigger_error() found. Debug code should not normally be used in production.
WARNINGSecurityInput is not sanitized1
- Category
- Security
- Occurrences
- 1
- Severity
- warning
Sample message
Detected usage of a non-sanitized input variable: $_SERVER['REQUEST_URI']
ERRORMaintainabilityfile system operations fwrite1
- Category
- Maintainability
- Occurrences
- 1
- Severity
- error
Sample message
File operations should use WP_Filesystem methods instead of direct PHP filesystem calls. Found: fwrite().
ERRORMaintainabilityNon Enqueued Script1
- Category
- Maintainability
- Occurrences
- 1
- Severity
- error
Sample message
Scripts must be registered/enqueued via wp_enqueue_script()
ERRORMaintainabilityNon Enqueued Stylesheet1
- Category
- Maintainability
- Occurrences
- 1
- Severity
- error
Sample message
Stylesheets must be registered/enqueued via wp_enqueue_style()
WARNINGMaintainabilitymismatched plugin name1
- Category
- Maintainability
- Occurrences
- 1
- Severity
- warning
Sample message
Plugin name "ZIP AI (Beta) – AI Website Builder, AI Agent & Assistant for WordPress" is different from the name declared in plugin header "ZIP AI".
External Connections
Potential connections found in static code analysis.
Outbound calls
31
External assets
2
Incoming endpoints
7
Notable Domains
modelcontextprotocol.io3 · outbound
credits.zipwp.com2 · outbound
php-fig.org2 · outbound
store.brainstormforce.com2 · outbound
anthropic.com1 · outbound
api.zipwp.com1 · outbound
Platform / Reference Domains
github.com4 · platform/reference
developer.wordpress.org3 · platform/reference
gnu.org2 · platform/reference
w3.org2 · platform/reference
External Asset Domains
fonts.googleapis.com3 · asset + outbound
Incoming Endpoints
/wp-json/zip-ai/v1/mcpREST
register_rest_route
/wp-json/zip-ai/v1/site-scanREST
register_rest_route
Admin AJAX endpoints5
wp_ajax_zip_ai_activate_setup_itemauthenticated
wp_ajax
wp_ajax_zip_ai_dismiss_setup_gateauthenticated
wp_ajax
wp_ajax_zip_ai_upload_mediaauthenticated
wp_ajax
wp_ajax_zipwp_clear_settingsauthenticated
wp_ajax
wp_ajax_zipwp_verify_auth_statusauthenticated
wp_ajax
Score History
First score snapshot
v0.0.7
37
Latest
- Findings
- 110
- Errors
- 23
- Warnings
- 87
- Check
- 2.0.0
| Scan | Score | Findings | Errors | Warnings | Plugin | Check |
|---|---|---|---|---|---|---|
| Latest | 37 | 110 | 23 | 87 | v0.0.7 | 2.0.0 |
Relationship Map
Author, categories, issues, domains, and nearby plugins.
Loading map
PluginAuthorCategoryIssueDomainRelated
Relationship links
Author
Issue
Nonce verification recommended19 findingsNon-prefixed hook name17 findingsDatabase parameter is not escaped10 findingsInterpolated SQL is not prepared10 findingsRequest data is not unslashed9 findingserror log error log7 findingswp function not compatible with requires wp7 findingsunlink unlink5 findings
Domain
Related
Contact Form 769 scoreElementor Website Builder – more than just a page builder39 scoreYoast SEO – Advanced SEO with real-time guidance and built-in AI24 scoreWooCommerce21 scoreAkismet Anti-spam: Spam Protection35 scoreLiteSpeed Cache35 scoreAll-in-One WP Migration and Backup34 scoreAll in One SEO – AI SEO Plugin to Boost SEO Rankings & Traffic (Schema, Local SEO, Sitemap & SEO Insights)92 scoreUltimate Addons for Elementor33 scoreAI Agent by SiteGround54 scoreSpectra Legacy – Gutenberg Blocks25 scoreStarter Templates – AI-Powered Templates for Elementor & Gutenberg24 scoreSureForms – Contact Form Builder, AI Forms, Payment Form, Survey & Quiz29 scoreCustom Fonts – Host Your Fonts Locally77 score
Author
Issue
Nonce verification recommended19 findingsNon-prefixed hook name17 findingsDatabase parameter is not escaped10 findingsInterpolated SQL is not prepared10 findingsRequest data is not unslashed9 findingserror log error log7 findingswp function not compatible with requires wp7 findingsunlink unlink5 findings
Domain
Related
Contact Form 769 scoreElementor Website Builder – more than just a page builder39 scoreYoast SEO – Advanced SEO with real-time guidance and built-in AI24 scoreWooCommerce21 scoreAkismet Anti-spam: Spam Protection35 scoreLiteSpeed Cache35 scoreAll-in-One WP Migration and Backup34 scoreAll in One SEO – AI SEO Plugin to Boost SEO Rankings & Traffic (Schema, Local SEO, Sitemap & SEO Insights)92 scoreUltimate Addons for Elementor33 scoreAI Agent by SiteGround54 scoreSpectra Legacy – Gutenberg Blocks25 scoreStarter Templates – AI-Powered Templates for Elementor & Gutenberg24 scoreSureForms – Contact Form Builder, AI Forms, Payment Form, Survey & Quiz29 scoreCustom Fonts – Host Your Fonts Locally77 score
Related Plugins
AI Puffer – Chat. Create. Automate. (formerly AI Power)
10k+ active installs
100
Easy MCP AI – Connector for Claude, ChatGPT & SEO Data
6k+ active installs
100
100
VigIA – AI Visibility, Analytics & Control
1k+ active installs
100
Share Buttons & AI-powered Summaries
1k+ active installs
100
Block AI Crawlers
1k+ active installs
100