Addon Elements for Elementor comes with 40+ widgets and extensions to extend the power of Elementor Page Builder.
Category Scores
Top Issues by Category
i18n3,764
security318
maintainability48
Issues Details
4,168 issues found in latest scan
Mismatched text domain. Expected 'addon-elements-for-elementor-page-builder' but got 'eae-wts'.
All output should be run through an escaping function (see the Security sections in the WordPress Developer Handbooks), found '" <div {$this->get_render_attribute_string('root')} >"'.
Using exclusionary parameters, like exclude, in calls to get_posts() should be done with caution, see https://wpvip.com/documentation/performance-improvements-by-removing-usage-of-post__not_in/ for more information.
Missing $domain parameter in function call to esc_html_x().
The $text parameter must be a single text string literal. Found: $is_active_tab['label']
$_GET['eae_nonce'] not unslashed before sanitization. Use wp_unslash() or similar
Detected usage of a non-sanitized input variable: $_GET['eae_nonce']
Detected usage of a possibly undefined superglobal array index: $_POST['eae_nonce']. Check that the array index exists before using it.
Hook names invoked by a theme/plugin should start with the theme/plugin prefix. Found: "eae/eae-icon-class".
PHP file should prevent direct access. Add a check like: if ( ! defined( 'ABSPATH' ) ) exit;
Global constants defined by a theme/plugin should start with the theme/plugin prefix. Found: "EAE_FILE".
Global variables defined by a theme/plugin should start with the theme/plugin prefix. Found: "$active_plugins".
Detected usage of meta_key, possible slow query.
Detected usage of meta_value, possible slow query.
In footer ($in_footer) is not set explicitly wp_enqueue_script; It is recommended to load scripts in the footer. Please set this value to `true` to load it in the footer, or explicitly `false` if it should be loaded in the header.
Detected usage of meta_query, possible slow query.
date() is affected by runtime timezone changes which can cause date/time to be incorrectly displayed. Use gmdate() instead.
Functions declared in the global namespace by a theme/plugin should start with the theme/plugin prefix. Found: "_is_elementor_installed".
error_log() found. Debug code should not normally be used in production.
A function call to __() with texts containing placeholders was found, but was not accompanied by a "translators:" comment on the line above to clarify the meaning of the placeholders.
Short URL detected (goo.gl). Use full URLs instead of URL shorteners.
Detected usage of tax_query, possible slow query.
Processing form data without nonce verification.
rand() is discouraged. Use the far less predictable wp_rand() instead.
Scripts must be registered/enqueued via wp_enqueue_script()
| Code | Type | Message | Count |
|---|---|---|---|
| WordPress.WP.I18n.TextDomainMismatch | ERROR | Mismatched text domain. Expected 'addon-elements-for-elementor-page-builder' but got 'eae-wts'. | 3,725 |
| WordPress.Security.EscapeOutput.OutputNotEscaped | ERROR | All output should be run through an escaping function (see the Security sections in the WordPress Developer Handbooks), found '" <div {$this->get_render_attribute_string('root')} >"'. | 286 |
| WordPressVIPMinimum.Performance.WPQueryParams.PostNotIn_exclude | WARNING | Using exclusionary parameters, like exclude, in calls to get_posts() should be done with caution, see https://wpvip.com/documentation/performance-improvements-by-removing-usage-of-post__not_in/ for more information. | 32 |
| WordPress.WP.I18n.MissingArgDomain | ERROR | Missing $domain parameter in function call to esc_html_x(). | 20 |
| WordPress.WP.I18n.NonSingularStringLiteralText | ERROR | The $text parameter must be a single text string literal. Found: $is_active_tab['label'] | 17 |
| WordPress.Security.ValidatedSanitizedInput.MissingUnslash | WARNING | $_GET['eae_nonce'] not unslashed before sanitization. Use wp_unslash() or similar | 11 |
| WordPress.Security.ValidatedSanitizedInput.InputNotSanitized | WARNING | Detected usage of a non-sanitized input variable: $_GET['eae_nonce'] | 10 |
| WordPress.Security.ValidatedSanitizedInput.InputNotValidated | WARNING | Detected usage of a possibly undefined superglobal array index: $_POST['eae_nonce']. Check that the array index exists before using it. | 10 |
| WordPress.NamingConventions.PrefixAllGlobals.NonPrefixedHooknameFound | WARNING | Hook names invoked by a theme/plugin should start with the theme/plugin prefix. Found: "eae/eae-icon-class". | 9 |
| missing_direct_file_access_protection | ERROR | PHP file should prevent direct access. Add a check like: if ( ! defined( 'ABSPATH' ) ) exit; | 8 |
| WordPress.NamingConventions.PrefixAllGlobals.NonPrefixedConstantFound | WARNING | Global constants defined by a theme/plugin should start with the theme/plugin prefix. Found: "EAE_FILE". | 6 |
| WordPress.NamingConventions.PrefixAllGlobals.NonPrefixedVariableFound | WARNING | Global variables defined by a theme/plugin should start with the theme/plugin prefix. Found: "$active_plugins". | 4 |
| WordPress.DB.SlowDBQuery.slow_db_query_meta_key | WARNING | Detected usage of meta_key, possible slow query. | 3 |
| WordPress.DB.SlowDBQuery.slow_db_query_meta_value | WARNING | Detected usage of meta_value, possible slow query. | 3 |
| WordPress.WP.EnqueuedResourceParameters.NotInFooter | WARNING | In footer ($in_footer) is not set explicitly wp_enqueue_script; It is recommended to load scripts in the footer. Please set this value to `true` to load it in the footer, or explicitly `false` if it should be loaded in the header. | 3 |
| WordPress.DB.SlowDBQuery.slow_db_query_meta_query | WARNING | Detected usage of meta_query, possible slow query. | 2 |
| WordPress.DateTime.RestrictedFunctions.date_date | ERROR | date() is affected by runtime timezone changes which can cause date/time to be incorrectly displayed. Use gmdate() instead. | 2 |
| WordPress.NamingConventions.PrefixAllGlobals.NonPrefixedFunctionFound | WARNING | Functions declared in the global namespace by a theme/plugin should start with the theme/plugin prefix. Found: "_is_elementor_installed". | 2 |
| WordPress.PHP.DevelopmentFunctions.error_log_error_log | WARNING | error_log() found. Debug code should not normally be used in production. | 2 |
| WordPress.WP.I18n.MissingTranslatorsComment | ERROR | A function call to __() with texts containing placeholders was found, but was not accompanied by a "translators:" comment on the line above to clarify the meaning of the placeholders. | 2 |
| PluginCheck.CodeAnalysis.ShortURL.Found | WARNING | Short URL detected (goo.gl). Use full URLs instead of URL shorteners. | 1 |
| WordPress.DB.SlowDBQuery.slow_db_query_tax_query | WARNING | Detected usage of tax_query, possible slow query. | 1 |
| WordPress.Security.NonceVerification.Missing | WARNING | Processing form data without nonce verification. | 1 |
| WordPress.WP.AlternativeFunctions.rand_rand | ERROR | rand() is discouraged. Use the far less predictable wp_rand() instead. | 1 |
| WordPress.WP.EnqueuedResources.NonEnqueuedScript | ERROR | Scripts must be registered/enqueued via wp_enqueue_script() | 1 |
Latest Snapshot
Findings
4,168
Errors
4,065
Warnings
103
Score History
First score snapshot
First scan completed
v1.14.5 · Plugin Check 2.0.0 · Model 2026.06-mvp-static-v2
v1.14.5
27
Latest
- Findings
- 4,168
- Errors
- 4,065
- Warnings
- 103
- Plugin Check
- 2.0.0
- Model
- 2026.06-mvp-static-v2
| Scan | Score | Findings | Errors | Warnings | Plugin | Plugin Check | Model |
|---|---|---|---|---|---|---|---|
| Latest | 27 | 4,168 | 4,065 | 103 | v1.14.5 | 2.0.0 | 2026.06-mvp-static-v2 |