Free AI chatbot with multiple bots, OpenAI & Claude & Gemini, contextual embeddings (local or Pinecone), PDF ingestion, usage limits & GDPR tools. RAG
| Code | Message | Location | Category | |
|---|---|---|---|---|
| ERROR | WordPress.WP.I18n.MissingTranslatorsComment | A function call to esc_html__() with texts containing placeholders was found, but was not accompanied by a "translators:" comment on the line above to clarify the meaning of the placeholders. | 87:57 | General |
| ERROR | PluginCheck.Security.DirectDB.UnescapedDBParameter | Unescaped parameter $sql used in $wpdb->get_results($wpdb->prepare($sql, $q_params))\n$sql assigned unsafely at line 78:\n $sql = "\r\n SELECT \r\n MIN(c.created_at) AS first_at,\r\n MAX(c.created_at) AS last_at,\r\n c.session_id,\r\n c.bot_slug,\r\n COUNT(*) AS messages,\r\n MAX(c.id) AS last_id,\r\n SUM( CASE WHEN c.user_id>0 THEN 1 ELSE 0 END ) AS has_user,\r\n MAX(c.user_id) AS any_user\r\n FROM $table c\r\n $where_sql\r\n GROUP BY c.session_id, c.bot_slug\r\n ORDER BY last_at DESC\r\n LIMIT %d OFFSET %d\r\n "\n$table assigned unsafely at line 5:\n $table = $wpdb->prefix.'aichat_tool_calls'\n$where_sql assigned unsafely at line 52:\n $where_sql = $where ? ('WHERE '.implode(' AND ',$where)) : ''\n$where assigned unsafely at line 48:\n $where[] = 'c.bot_slug = %s'\n$bot_slug assigned unsafely at line 30:\n $bot_slug = isset($_GET['bot_slug']) ? sanitize_title($_GET['bot_slug']) : ''\nNote: sanitize_title() is not a safe escaping function.\n$_GET['bot_slug'] used without escaping. | 100:24 | Security |
| ERROR | WordPress.DB.PreparedSQL.NotPrepared | Use placeholders and $wpdb->prepare(); found $sql | 100:52 | Security |
| ERROR | WordPress.WP.I18n.MissingTranslatorsComment | A function call to __() with texts containing placeholders was found, but was not accompanied by a "translators:" comment on the line above to clarify the meaning of the placeholders. | 62:80 | General |
| ERROR | WordPress.NamingConventions.PrefixAllGlobals.NonPrefixedVariableFound | Global variables defined by a theme/plugin should start with the theme/plugin prefix. Found: "$bot". | 65:58 | Plugin Repo |
| ERROR | PluginCheck.Security.DirectDB.UnescapedDBParameter | Unescaped parameter $sql used in $wpdb->get_results($wpdb->prepare($sql, [ $per_page, $offset ] ))\n$sql assigned unsafely at line 78:\n $sql = "\r\n SELECT \r\n MIN(c.created_at) AS first_at,\r\n MAX(c.created_at) AS last_at,\r\n c.session_id,\r\n c.bot_slug,\r\n COUNT(*) AS messages,\r\n MAX(c.id) AS last_id,\r\n SUM( CASE WHEN c.user_id>0 THEN 1 ELSE 0 END ) AS has_user,\r\n MAX(c.user_id) AS any_user\r\n FROM $table c\r\n $where_sql\r\n GROUP BY c.session_id, c.bot_slug\r\n ORDER BY last_at DESC\r\n LIMIT %d OFFSET %d\r\n "\n$table assigned unsafely at line 5:\n $table = $wpdb->prefix.'aichat_tool_calls'\n$where_sql assigned unsafely at line 52:\n $where_sql = $where ? ('WHERE '.implode(' AND ',$where)) : ''\n$where assigned unsafely at line 48:\n $where[] = 'c.bot_slug = %s'\n$bot_slug assigned unsafely at line 30:\n $bot_slug = isset($_GET['bot_slug']) ? sanitize_title($_GET['bot_slug']) : ''\nNote: sanitize_title() is not a safe escaping function.\n$_GET['bot_slug'] used without escaping. | 103:24 | Security |
| ERROR | WordPress.DB.PreparedSQL.NotPrepared | Use placeholders and $wpdb->prepare(); found $sql | 103:52 | Security |
| ERROR | WordPress.NamingConventions.PrefixAllGlobals.NonPrefixedVariableFound | Global variables defined by a theme/plugin should start with the theme/plugin prefix. Found: "$embed_origins_raw". | 89:27 | Plugin Repo |
| ERROR | PluginCheck.Security.DirectDB.UnescapedDBParameter | Unescaped parameter $count_sql used in $wpdb->get_var($wpdb->prepare($count_sql, $where_params))\n$count_sql assigned unsafely at line 326:\n $count_sql = "SELECT COUNT(*) FROM $chunks_table c WHERE $where_sql"\n$where_sql assigned unsafely at line 323:\n $where_sql = implode(' AND ', $where_clauses)\n$where_clauses assigned unsafely at line 319:\n $where_clauses[] = '(c.title LIKE %s OR c.content LIKE %s)'\n$where_params[] used without escaping. | 327:26 | Security |
| ERROR | PluginCheck.Security.DirectDB.UnescapedDBParameter | Unescaped parameter $sql_last used in $wpdb->get_results($wpdb->prepare($sql_last, $last_ids))\n$sql_last assigned unsafely at line 112:\n $sql_last = "SELECT id, response, message FROM $table WHERE id IN ($placeholders)"\n$table assigned unsafely at line 5:\n $table = $wpdb->prefix.'aichat_tool_calls' | 113:28 | Security |
| 17.11.2025, 10:33:12 | 43s | 10 | 52 | 684 |
| Source | Host | URL | Plugin File / Stack | Captured |
|---|---|---|---|---|
| Static | tu-dominio | https://tu-dominio/wp-content/plugins/axiachat-ai/assets/js/aichat-embed-loader.js | assets/js/aichat-embed-loader.js:5 | 11/17/2025, 10:33:20 AM |
| Static | domain | https://domain/.../assets/js/aichat-embed-loader.js | assets/js/aichat-embed-loader.js:17 | 11/17/2025, 10:33:20 AM |
| Static | controller.pinecone.io | https://controller.pinecone.io/ | assets/js/contexto-create.js:280 | 11/17/2025, 10:33:20 AM |
| Static | controller.pinecone.io | https://controller.pinecone.io/ | assets/js/contexto-create.js:314 | 11/17/2025, 10:33:20 AM |
| Static | wpbotwriter.com | https://wpbotwriter.com/axiachat-ai | axiachat-ai.php:4 | 11/17/2025, 10:33:20 AM |
| Static | wpbotwriter.com | https://wpbotwriter.com/ | axiachat-ai.php:10 | 11/17/2025, 10:33:20 AM |
| Static | wpbotwriter.com | https://wpbotwriter.com/log-a-support-ticket/ | includes/add-ons/ai-tools/admin-settings.php:54 | 11/17/2025, 10:33:20 AM |
| Static | ai.google.dev | https://ai.google.dev/gemini-api/docs/function-calling#multi-tool-use | includes/add-ons/ai-tools/api.php:305 | 11/17/2025, 10:33:20 AM |
| Static | docs.anthropic.com | https://docs.anthropic.com/en/docs/build-with-claude/tool-use/web-search-tool | includes/add-ons/ai-tools/api.php:415 | 11/17/2025, 10:33:20 AM |
| Static | ai.google.dev | https://ai.google.dev/gemini-api/docs/function-calling#multi-tool-use | includes/add-ons/ai-tools/tools-sample.php:73 | 11/17/2025, 10:33:20 AM |