Adds conditional logic to Contact Form 7.
Category Scores
Top Issues by Category
security138
maintainability26
Issues Details
165 issues found in latest scan
All output should be run through an escaping function (see the Security sections in the WordPress Developer Handbooks), found '$class_html'.
All output should be run through an escaping function (like esc_html_e() or esc_attr_e()), found '_e'.
Processing form data without nonce verification.
Functions declared in the global namespace by a theme/plugin should start with the theme/plugin prefix. Found: "add_conditional_panel".
Global variables defined by a theme/plugin should start with the theme/plugin prefix. Found: "$active_plugins".
Processing form data without nonce verification.
$_GET['post'] not unslashed before sanitization. Use wp_unslash() or similar
PHP file should prevent direct access. Add a check like: if ( ! defined( 'ABSPATH' ) ) exit;
Detected usage of a non-sanitized input variable: $_GET['post']
Classes declared by a theme/plugin should start with the theme/plugin prefix. Found: "CF7CF".
Global constants defined by a theme/plugin should start with the theme/plugin prefix. Found: "WPCF7_ADMIN_READ_WRITE_CAPABILITY".
Hook names invoked by a theme/plugin should start with the theme/plugin prefix. Found: "wpcf7_config_validator_available_error_codes".
Detected usage of a possibly undefined superglobal array index: $_POST['_wpnonce']. Check that the array index exists before using it.
Mismatched text domain. Expected 'cf7-conditional-fields' but got 'contact-form-7'.
| Code | Type | Message | Count |
|---|---|---|---|
| WordPress.Security.EscapeOutput.OutputNotEscaped | ERROR | All output should be run through an escaping function (see the Security sections in the WordPress Developer Handbooks), found '$class_html'. | 78 |
| WordPress.Security.EscapeOutput.UnsafePrintingFunction | ERROR | All output should be run through an escaping function (like esc_html_e() or esc_attr_e()), found '_e'. | 26 |
| WordPress.Security.NonceVerification.Missing | WARNING | Processing form data without nonce verification. | 15 |
| WordPress.NamingConventions.PrefixAllGlobals.NonPrefixedFunctionFound | WARNING | Functions declared in the global namespace by a theme/plugin should start with the theme/plugin prefix. Found: "add_conditional_panel". | 7 |
| WordPress.NamingConventions.PrefixAllGlobals.NonPrefixedVariableFound | WARNING | Global variables defined by a theme/plugin should start with the theme/plugin prefix. Found: "$active_plugins". | 7 |
| WordPress.Security.NonceVerification.Recommended | WARNING | Processing form data without nonce verification. | 7 |
| WordPress.Security.ValidatedSanitizedInput.MissingUnslash | WARNING | $_GET['post'] not unslashed before sanitization. Use wp_unslash() or similar | 6 |
| missing_direct_file_access_protection | ERROR | PHP file should prevent direct access. Add a check like: if ( ! defined( 'ABSPATH' ) ) exit; | 6 |
| WordPress.Security.ValidatedSanitizedInput.InputNotSanitized | WARNING | Detected usage of a non-sanitized input variable: $_GET['post'] | 5 |
| WordPress.NamingConventions.PrefixAllGlobals.NonPrefixedClassFound | WARNING | Classes declared by a theme/plugin should start with the theme/plugin prefix. Found: "CF7CF". | 1 |
| WordPress.NamingConventions.PrefixAllGlobals.NonPrefixedConstantFound | WARNING | Global constants defined by a theme/plugin should start with the theme/plugin prefix. Found: "WPCF7_ADMIN_READ_WRITE_CAPABILITY". | 1 |
| WordPress.NamingConventions.PrefixAllGlobals.NonPrefixedHooknameFound | WARNING | Hook names invoked by a theme/plugin should start with the theme/plugin prefix. Found: "wpcf7_config_validator_available_error_codes". | 1 |
| WordPress.Security.ValidatedSanitizedInput.InputNotValidated | WARNING | Detected usage of a possibly undefined superglobal array index: $_POST['_wpnonce']. Check that the array index exists before using it. | 1 |
| WordPress.WP.I18n.TextDomainMismatch | ERROR | Mismatched text domain. Expected 'cf7-conditional-fields' but got 'contact-form-7'. | 1 |
| badly_named_files | ERROR | File and folder names must not contain spaces or special characters. | 1 |
| library_core_files | ERROR | Library files that are already in the WordPress core are not permitted. | 1 |
| upgrade_notice_limit | WARNING | The upgrade notice for "2.2.10" exceeds the limit of 300 characters. | 1 |
Latest Snapshot
Findings
165
Errors
113
Warnings
52
Score History
First score snapshot
First scan completed Jun 19, 2026
v2.7.8 · Plugin Check 2.0.0 · Model 2026.06-mvp-static-v2
Jun 19, 2026
v2.7.8
41
Latest
- Findings
- 165
- Errors
- 113
- Warnings
- 52
- Plugin Check
- 2.0.0
- Model
- 2026.06-mvp-static-v2
| Scan | Score | Findings | Errors | Warnings | Plugin | Plugin Check | Model |
|---|---|---|---|---|---|---|---|
| Jun 19, 2026Latest | 41 | 165 | 113 | 52 | v2.7.8 | 2.0.0 | 2026.06-mvp-static-v2 |