Smash Balloon Social Post Feed – Simple Social Feeds for WordPress

All output should be run through an escaping function (see the Security sections in the WordPress Developer Handbooks), found '$avatar_class'.

Global variables defined by a theme/plugin should start with the theme/plugin prefix. Found: "$all_sources".

Use placeholders and $wpdb->prepare(); found interpolated variable $cache_table_name at "UPDATE $cache_table_name\n

Use of a direct database call is discouraged.

Direct database call without caching detected. Consider using wp_cache_get() / wp_cache_set() or wp_cache_delete().

Hook names invoked by a theme/plugin should start with the theme/plugin prefix. Found: "cff_admin_notices".

$_GET['_wpnonce'] not unslashed before sanitization. Use wp_unslash() or similar

PHP file should prevent direct access. Add a check like: if ( ! defined( 'ABSPATH' ) ) exit;

Unescaped parameter $cache_table_name used in $wpdb->query()\n$cache_table_name assigned unsafely at line 397.

Processing form data without nonce verification.

date() is affected by runtime timezone changes which can cause date/time to be incorrectly displayed. Use gmdate() instead.

No PHP code was found in this file and short open tags are not allowed by this install of PHP. This file may be using short open tags but PHP does not allow them.

Detected usage of a non-sanitized input variable: $_FILES['file']['name']

A function call to __() with texts containing placeholders was found, but was not accompanied by a "translators:" comment on the line above to clarify the meaning of the placeholders.

Mismatched text domain. Expected 'custom-facebook-feed' but got ''.

Functions declared in the global namespace by a theme/plugin should start with the theme/plugin prefix. Found: "cffGetOembedConnectionUrl".

Detected usage of a possibly undefined superglobal array index: $_FILES['file']['name']. Check that the array index exists before using it.

Multiple placeholders in translatable strings should be ordered. Expected "%1$s, %2$s", but got "%s, %s" in '%sLearn more about custom formats %s'.

Unescaped parameter $in used in $wpdb->get_results()\n$in assigned unsafely at line 616.

Use placeholders and $wpdb->prepare(); found $sql

Global constants defined by a theme/plugin should start with the theme/plugin prefix. Found: "CFFVER".

Missing $domain parameter in function call to __().

Attempting a database schema change is discouraged.

Found call to wp_enqueue_script() with external resource. Offloading scripts to your servers or any remote service is disallowed.

rand() is discouraged. Use the far less predictable wp_rand() instead.