Easily add email subscription form to your website using shortcode and widget.
Category Scores
Top Issues by Category
security295
maintainability256
Issues Details
576 issues found in latest scan
All output should be run through an escaping function (see the Security sections in the WordPress Developer Handbooks), found '" --> Body: {$resp->body}"'.
All output should be run through an escaping function (like esc_html_e() or esc_attr_e()), found '_e'.
Global variables defined by a theme/plugin should start with the theme/plugin prefix. Found: "$args".
Using cURL functions is highly discouraged. Use wp_remote_get() instead.
Classes declared by a theme/plugin should start with the theme/plugin prefix. Found: "AC_Account".
Processing form data without nonce verification.
PHP file should prevent direct access. Add a check like: if ( ! defined( 'ABSPATH' ) ) exit;
Detected usage of a non-sanitized input variable: $_POST['blossomthemes_email_newsletter_setting']
$_POST['bten_sendin_api_key'] not unslashed before sanitization. Use wp_unslash() or similar
All output should be run through an escaping function (see the Security sections in the WordPress Developer Handbooks), found '$data['error']'.
Using cURL functions is highly discouraged. Use wp_remote_get() instead.
Detected usage of a possibly undefined superglobal array index: $_POST['email']. Check that the array index exists before using it.
Using cURL functions is highly discouraged. Use wp_remote_get() instead.
A function call to __() with texts containing placeholders was found, but was not accompanied by a "translators:" comment on the line above to clarify the meaning of the placeholders.
Using cURL functions is highly discouraged. Use wp_remote_get() instead.
Hook names invoked by a theme/plugin should start with the theme/plugin prefix. Found: "bten_icon_header_img_size".
Processing form data without nonce verification.
Using cURL functions is highly discouraged. Use wp_remote_get() instead.
Using cURL functions is highly discouraged. Use wp_remote_get() instead.
Functions declared in the global namespace by a theme/plugin should start with the theme/plugin prefix. Found: "activate_blossomthemes_email_newsletter".
trigger_error() found. Debug code should not normally be used in production.
error_log() found. Debug code should not normally be used in production.
Using cURL functions is highly discouraged. Use wp_remote_get() instead.
Global constants defined by a theme/plugin should start with the theme/plugin prefix. Found: "ACTIVECAMPAIGN_API_KEY".
Interfaces declared by a theme/plugin should start with the theme/plugin prefix. Found: "AWeberOAuthAdapter".
| Code | Type | Message | Count |
|---|---|---|---|
| WordPress.Security.EscapeOutput.OutputNotEscaped | ERROR | All output should be run through an escaping function (see the Security sections in the WordPress Developer Handbooks), found '" --> Body: {$resp->body}"'. | 97 |
| WordPress.Security.EscapeOutput.UnsafePrintingFunction | ERROR | All output should be run through an escaping function (like esc_html_e() or esc_attr_e()), found '_e'. | 88 |
| WordPress.NamingConventions.PrefixAllGlobals.NonPrefixedVariableFound | WARNING | Global variables defined by a theme/plugin should start with the theme/plugin prefix. Found: "$args". | 69 |
| WordPress.WP.AlternativeFunctions.curl_curl_setopt | ERROR | Using cURL functions is highly discouraged. Use wp_remote_get() instead. | 51 |
| WordPress.NamingConventions.PrefixAllGlobals.NonPrefixedClassFound | WARNING | Classes declared by a theme/plugin should start with the theme/plugin prefix. Found: "AC_Account". | 45 |
| WordPress.Security.NonceVerification.Missing | WARNING | Processing form data without nonce verification. | 38 |
| missing_direct_file_access_protection | ERROR | PHP file should prevent direct access. Add a check like: if ( ! defined( 'ABSPATH' ) ) exit; | 32 |
| WordPress.Security.ValidatedSanitizedInput.InputNotSanitized | WARNING | Detected usage of a non-sanitized input variable: $_POST['blossomthemes_email_newsletter_setting'] | 23 |
| WordPress.Security.ValidatedSanitizedInput.MissingUnslash | WARNING | $_POST['bten_sendin_api_key'] not unslashed before sanitization. Use wp_unslash() or similar | 20 |
| WordPress.Security.EscapeOutput.ExceptionNotEscaped | ERROR | All output should be run through an escaping function (see the Security sections in the WordPress Developer Handbooks), found '$data['error']'. | 14 |
| WordPress.WP.AlternativeFunctions.curl_curl_init | ERROR | Using cURL functions is highly discouraged. Use wp_remote_get() instead. | 10 |
| WordPress.Security.ValidatedSanitizedInput.InputNotValidated | WARNING | Detected usage of a possibly undefined superglobal array index: $_POST['email']. Check that the array index exists before using it. | 9 |
| WordPress.WP.AlternativeFunctions.curl_curl_close | ERROR | Using cURL functions is highly discouraged. Use wp_remote_get() instead. | 8 |
| WordPress.WP.I18n.MissingTranslatorsComment | ERROR | A function call to __() with texts containing placeholders was found, but was not accompanied by a "translators:" comment on the line above to clarify the meaning of the placeholders. | 8 |
| WordPress.WP.AlternativeFunctions.curl_curl_exec | ERROR | Using cURL functions is highly discouraged. Use wp_remote_get() instead. | 7 |
| WordPress.NamingConventions.PrefixAllGlobals.NonPrefixedHooknameFound | WARNING | Hook names invoked by a theme/plugin should start with the theme/plugin prefix. Found: "bten_icon_header_img_size". | 6 |
| WordPress.Security.NonceVerification.Recommended | WARNING | Processing form data without nonce verification. | 6 |
| WordPress.WP.AlternativeFunctions.curl_curl_error | ERROR | Using cURL functions is highly discouraged. Use wp_remote_get() instead. | 5 |
| WordPress.WP.AlternativeFunctions.curl_curl_getinfo | ERROR | Using cURL functions is highly discouraged. Use wp_remote_get() instead. | 5 |
| WordPress.NamingConventions.PrefixAllGlobals.NonPrefixedFunctionFound | WARNING | Functions declared in the global namespace by a theme/plugin should start with the theme/plugin prefix. Found: "activate_blossomthemes_email_newsletter". | 4 |
| WordPress.PHP.DevelopmentFunctions.error_log_trigger_error | WARNING | trigger_error() found. Debug code should not normally be used in production. | 4 |
| WordPress.PHP.DevelopmentFunctions.error_log_error_log | WARNING | error_log() found. Debug code should not normally be used in production. | 3 |
| WordPress.WP.AlternativeFunctions.curl_curl_setopt_array | ERROR | Using cURL functions is highly discouraged. Use wp_remote_get() instead. | 3 |
| WordPress.NamingConventions.PrefixAllGlobals.NonPrefixedConstantFound | WARNING | Global constants defined by a theme/plugin should start with the theme/plugin prefix. Found: "ACTIVECAMPAIGN_API_KEY". | 2 |
| WordPress.NamingConventions.PrefixAllGlobals.NonPrefixedInterfaceFound | WARNING | Interfaces declared by a theme/plugin should start with the theme/plugin prefix. Found: "AWeberOAuthAdapter". | 2 |
Latest Snapshot
Findings
576
Errors
337
Warnings
239
Score History
First score snapshot
First scan completed Jun 20, 2026
v2.2.11 · Plugin Check 2.0.0 · Model 2026.06-mvp-static-v2
Jun 20, 2026
v2.2.11
23
Latest
- Findings
- 576
- Errors
- 337
- Warnings
- 239
- Plugin Check
- 2.0.0
- Model
- 2026.06-mvp-static-v2
| Scan | Score | Findings | Errors | Warnings | Plugin | Plugin Check | Model |
|---|---|---|---|---|---|---|---|
| Jun 20, 2026Latest | 23 | 576 | 337 | 239 | v2.2.11 | 2.0.0 | 2026.06-mvp-static-v2 |