Zoho CRM Lead Magnet

Websites are one of the most important sources of leads for your business.

v1.8.2.3zohocrmUpdated Added 3k+ installs62% rating
30
Score
101
Errors
1,025
Warnings
+0
Change

Category Scores

Security0
Repo94
Performance100
Maintainability30

Issues to Review

Prioritized issue groups from the latest Plugin Check scan

1,126 findings

Security

787

11 issue groups

Maintainability

331

13 issue groups

I18n

2

1 issue group

WARNINGSecurityRequest data is not unslashed$_POST[$config_fields[$i]['name']] not unslashed before sanitization. Use wp_unslash() or similar238
Category
Security
Occurrences
238
Severity
warning

Sample message

$_POST[$config_fields[$i]['name']] not unslashed before sanitization. Use wp_unslash() or similar

WARNINGSecurityInput is not validatedDetected usage of a possibly undefined superglobal array index: $_POST[$config_fields[$i]['name']][$index]. Check that the array index exists before using it.186
Category
Security
Occurrences
186
Severity
warning

Sample message

Detected usage of a possibly undefined superglobal array index: $_POST[$config_fields[$i]['name']][$index]. Check that the array index exists before using it.

WARNINGMaintainabilityDirect QueryUse of a direct database call is discouraged.146
Category
Maintainability
Occurrences
146
Severity
warning

Sample message

Use of a direct database call is discouraged.

WARNINGMaintainabilityNo CachingDirect database call without caching detected. Consider using wp_cache_get() / wp_cache_set() or wp_cache_delete().134
Category
Maintainability
Occurrences
134
Severity
warning

Sample message

Direct database call without caching detected. Consider using wp_cache_get() / wp_cache_set() or wp_cache_delete().

WARNINGSecurityNonce verification recommendedProcessing form data without nonce verification.132
Category
Security
Occurrences
132
Severity
warning

Sample message

Processing form data without nonce verification.

WARNINGSecurityMissing nonce verificationProcessing form data without nonce verification.96
Category
Security
Occurrences
96
Severity
warning

Sample message

Processing form data without nonce verification.

ERRORSecuritySQL query is not preparedUse placeholders and $wpdb->prepare(); found $blogusersquery43
Category
Security
Occurrences
43
Severity
error

Sample message

Use placeholders and $wpdb->prepare(); found $blogusersquery

WARNINGSecurityInput is not sanitizedDetected usage of a non-sanitized input variable: $_POST['nonce']35
Category
Security
Occurrences
35
Severity
warning

Sample message

Detected usage of a non-sanitized input variable: $_POST['nonce']

ERRORSecurityDatabase parameter is not escapedUnescaped parameter $config_query used in $wpdb->get_results()\n$config_query assigned unsafely at line 225.28
Category
Security
Occurrences
28
Severity
error

Sample message

Unescaped parameter $config_query used in $wpdb->get_results()\n$config_query assigned unsafely at line 225.

WARNINGSecurityInput is not validated or sanitizedDetected usage of a non-sanitized, non-validated input variable _SESSION: "<div id='crmformsLogMsg{$_SESSION["generated_forms"]}'></div>"17
Category
Security
Occurrences
17
Severity
warning

Sample message

Detected usage of a non-sanitized, non-validated input variable _SESSION: "<div id='crmformsLogMsg{$_SESSION["generated_forms"]}'></div>"

Show 15 more
ERRORMaintainabilitydate date14
Category
Maintainability
Occurrences
14
Severity
error

Sample message

date() is affected by runtime timezone changes which can cause date/time to be incorrectly displayed. Use gmdate() instead.

WARNINGMaintainabilitySchema Change11
Category
Maintainability
Occurrences
11
Severity
warning

Sample message

Attempting a database schema change is discouraged.

WARNINGSecurityUnnecessary Prepare7
Category
Security
Occurrences
7
Severity
warning

Sample message

It is not necessary to prepare a query which doesn't use variable replacement.

WARNINGMaintainabilityMissing Version7
Category
Maintainability
Occurrences
7
Severity
warning

Sample message

Resource version not set in call to wp_enqueue_style(). This means new versions of the style may not always be loaded due to browser caching.

WARNINGMaintainabilityerror log print r5
Category
Maintainability
Occurrences
5
Severity
warning

Sample message

print_r() found. Debug code should not normally be used in production.

WARNINGMaintainabilityDiscouraged PHP function4
Category
Maintainability
Occurrences
4
Severity
warning

Sample message

The use of function ini_set() is discouraged

WARNINGSecurityInterpolated SQL is not prepared4
Category
Security
Occurrences
4
Severity
warning

Sample message

Use placeholders and $wpdb->prepare(); found interpolated variable $field_id at "update zcf_zohocrmform_field_manager set editupdate = '0' where field_id ='$field_id'"

ERRORMaintainabilityMissing direct file access protection3
Category
Maintainability
Occurrences
3
Severity
error

Sample message

PHP file should prevent direct access. Add a check like: if ( ! defined( 'ABSPATH' ) ) exit;

ERRORMaintainabilityparse url parse url2
Category
Maintainability
Occurrences
2
Severity
error

Sample message

parse_url() is discouraged because of inconsistency in the output across PHP versions; use wp_parse_url() instead.

ERRORMaintainabilityrand rand2
Category
Maintainability
Occurrences
2
Severity
error

Sample message

rand() is discouraged. Use the far less predictable wp_rand() instead.

ERRORI18nNo Empty Strings2
Category
I18n
Occurrences
2
Severity
error

Sample message

The $text text string should have translatable content. Found: ' '

WARNINGMaintainabilityslow db query meta key1
Category
Maintainability
Occurrences
1
Severity
warning

Sample message

Detected usage of meta_key, possible slow query.

WARNINGMaintainabilityslow db query meta value1
Category
Maintainability
Occurrences
1
Severity
warning

Sample message

Detected usage of meta_value, possible slow query.

ERRORSecurityOutput is not escaped1
Category
Security
Occurrences
1
Severity
error

Sample message

All output should be run through an escaping function (see the Security sections in the WordPress Developer Handbooks), found '$third_module_pluginname'.

ERRORMaintainabilityfile system operations fclose1
Category
Maintainability
Occurrences
1
Severity
error

Sample message

File operations should use WP_Filesystem methods instead of direct PHP filesystem calls. Found: fclose().

External Connections

Not analyzed yet.

Score History

First score snapshot

v1.8.2.3

30

Latest

Findings
1,126
Errors
101
Warnings
1,025
Check
2.0.0

Relationship Map

Author, categories, issues, domains, and nearby plugins.

29 nodes

Related Plugins

DS CF7 Math Captcha

10k+ active installs

100
100
Style Contact Form 7

1k+ active installs

100
Masks Form Fields

9k+ active installs

99