Autoptimize

All output should be run through an escaping function (see the Security sections in the WordPress Developer Handbooks), found '$_ao_ccss_review_notice_copy'.

Sanitization missing for register_setting().

Global variables defined by a theme/plugin should start with the theme/plugin prefix. Found: "$_ao_ccss_review_notice_copy".

All output should be run through an escaping function (like esc_html_e() or esc_attr_e()), found '_e'.

Detected usage of a non-sanitized input variable: $_FILES['file']['error']

$_GET['page'] not unslashed before sanitization. Use wp_unslash() or similar

parse_url() is discouraged because of inconsistency in the output across PHP versions; use wp_parse_url() instead.

Detected usage of a possibly undefined superglobal array index: $_FILES['file']['error']. Check that the array index exists before using it.

Processing form data without nonce verification.

Global constants defined by a theme/plugin should start with the theme/plugin prefix. Found: "AO_CCSS_API".

unlink() is discouraged. Use wp_delete_file() to delete a file.

PHP file should prevent direct access. Add a check like: if ( ! defined( 'ABSPATH' ) ) exit;

A function call to esc_html__() with texts containing placeholders was found, but was not accompanied by a "translators:" comment on the line above to clarify the meaning of the placeholders.

print_r() found. Debug code should not normally be used in production.

Missing $domain parameter in function call to esc_html__().

Use of a direct database call is discouraged.

Direct database call without caching detected. Consider using wp_cache_get() / wp_cache_set() or wp_cache_delete().

Classes declared by a theme/plugin should start with the theme/plugin prefix. Found: "AO_Minify_HTML".

Functions declared in the global namespace by a theme/plugin should start with the theme/plugin prefix. Found: "ao_ccss_render_adv".

error_log() found. Debug code should not normally be used in production.

All output should be run through an escaping function (see the Security sections in the WordPress Developer Handbooks), found '": {$pattern}"'.

The use of function move_uploaded_file() is forbidden

Hook names invoked by a theme/plugin should start with the theme/plugin prefix. Found: "ao_ccss_queue_schedule".

Plugin folders are deleted when upgraded. Do not save data to the plugin folder using file_put_contents(). Detected usage of __FILE__ or __DIR__ magic constant. Use wp_upload_dir() to get the uploads directory path or save to the database instead.

Processing form data without nonce verification.