PluginScore

EmbedPress – PDF Embedder, Embed PDF viewer, YouTube Videos, 3D FlipBook, Social feeds & more

EmbedPress lets you embed videos, pages, social feeds, embed PDF 3D flipbooks & other content on WordPress without coding & enhance storytelling.

v4.5.6WPDeveloperUpdated Added 100k+ installs96% rating67% support resolved
Embed youtubeembedembed pdfgoogle docssocial feeds
24
Score
669
Errors
1,550
Warnings
+0
Change

Category Scores

Security0
Repo94
Performance100
Maintainability0

Issues to Review

Prioritized issue groups from the latest Plugin Check scan

2,219 findings

Security

1,205

12 issue groups

Maintainability

794

11 issue groups

I18n

126

2 issue groups

ERRORSecurityOutput is not escapedAll output should be run through an escaping function (see the Security sections in the WordPress Developer Handbooks), found '"[$k]=>\"$v\", "'.258
Category
Security
Occurrences
258
Severity
error

Sample message

All output should be run through an escaping function (see the Security sections in the WordPress Developer Handbooks), found '"[$k]=>\"$v\", "'.

WordPress.Security.EscapeOutput.OutputNotEscapedReference
WARNINGMaintainabilityNon-prefixed global variableGlobal variables defined by a theme/plugin should start with the theme/plugin prefix. Found: "$additionalServiceProviders".244
Category
Maintainability
Occurrences
244
Severity
warning

Sample message

Global variables defined by a theme/plugin should start with the theme/plugin prefix. Found: "$additionalServiceProviders".

WordPress.NamingConventions.PrefixAllGlobals.NonPrefixedVariableFound
WARNINGSecurityInterpolated SQL is not preparedUse placeholders and $wpdb->prepare(); found interpolated variable $browser_table at FROM $browser_table\n225
Category
Security
Occurrences
225
Severity
warning

Sample message

Use placeholders and $wpdb->prepare(); found interpolated variable $browser_table at FROM $browser_table\n

WordPress.DB.PreparedSQL.InterpolatedNotPrepared
WARNINGSecurityRequest data is not unslashed$_COOKIE['ep_session_id'] not unslashed before sanitization. Use wp_unslash() or similar195
Category
Security
Occurrences
195
Severity
warning

Sample message

$_COOKIE['ep_session_id'] not unslashed before sanitization. Use wp_unslash() or similar

WordPress.Security.ValidatedSanitizedInput.MissingUnslash
WARNINGSecurityMissing nonce verificationProcessing form data without nonce verification.180
Category
Security
Occurrences
180
Severity
warning

Sample message

Processing form data without nonce verification.

WordPress.Security.NonceVerification.Missing
WARNINGMaintainabilityDirect QueryUse of a direct database call is discouraged.151
Category
Maintainability
Occurrences
151
Severity
warning

Sample message

Use of a direct database call is discouraged.

WordPress.DB.DirectDatabaseQuery.DirectQuery
WARNINGMaintainabilityNo CachingDirect database call without caching detected. Consider using wp_cache_get() / wp_cache_set() or wp_cache_delete().143
Category
Maintainability
Occurrences
143
Severity
warning

Sample message

Direct database call without caching detected. Consider using wp_cache_get() / wp_cache_set() or wp_cache_delete().

WordPress.DB.DirectDatabaseQuery.NoCaching
WARNINGSecurityDatabase parameter is not escapedUnescaped parameter $browser_table used in $wpdb->get_results()\n$browser_table assigned unsafely at line 250.130
Category
Security
Occurrences
130
Severity
warning

Sample message

Unescaped parameter $browser_table used in $wpdb->get_results()\n$browser_table assigned unsafely at line 250.

PluginCheck.Security.DirectDB.UnescapedDBParameter
ERRORI18nMissing Translators CommentA function call to __() with texts containing placeholders was found, but was not accompanied by a "translators:" comment on the line above to clarify the meaning of the placeholders.116
Category
I18n
Occurrences
116
Severity
error

Sample message

A function call to __() with texts containing placeholders was found, but was not accompanied by a "translators:" comment on the line above to clarify the meaning of the placeholders.

WordPress.WP.I18n.MissingTranslatorsCommentReference
ERRORMaintainabilityMissing direct file access protectionPHP file should prevent direct access. Add a check like: if ( ! defined( 'ABSPATH' ) ) exit;84
Category
Maintainability
Occurrences
84
Severity
error

Sample message

PHP file should prevent direct access. Add a check like: if ( ! defined( 'ABSPATH' ) ) exit;

missing_direct_file_access_protectionReference
Show 15 more
WARNINGSecurityInput is not sanitized74
Category
Security
Occurrences
74
Severity
warning

Sample message

Detected usage of a non-sanitized input variable: $_COOKIE['ep_session_id']

WordPress.Security.ValidatedSanitizedInput.InputNotSanitized
WARNINGSecurityNonce verification recommended60
Category
Security
Occurrences
60
Severity
warning

Sample message

Processing form data without nonce verification.

WordPress.Security.NonceVerification.Recommended
WARNINGMaintainabilityNon-prefixed hook name56
Category
Maintainability
Occurrences
56
Severity
warning

Sample message

Hook names invoked by a theme/plugin should start with the theme/plugin prefix. Found: "'wpins_form_text_' . $this->plugin_name".

WordPress.NamingConventions.PrefixAllGlobals.NonPrefixedHooknameFound
WARNINGMaintainabilitySchema Change31
Category
Maintainability
Occurrences
31
Severity
warning

Sample message

Attempting a database schema change is discouraged.

WordPress.DB.DirectDatabaseQuery.SchemaChange
ERRORMaintainabilitywp function not compatible with requires wp29
Category
Maintainability
Occurrences
29
Severity
error

Sample message

Function "determine_locale()" requires WordPress 5.0.0, but your plugin minimum supported version is WordPress 4.6.0.

wp_function_not_compatible_with_requires_wpReference
ERRORSecurityUnsafe printing function28
Category
Security
Occurrences
28
Severity
error

Sample message

All output should be run through an escaping function (like esc_html_e() or esc_attr_e()), found '_e'.

WordPress.Security.EscapeOutput.UnsafePrintingFunctionReference
WARNINGSecurityInput is not validated18
Category
Security
Occurrences
18
Severity
warning

Sample message

Detected usage of a possibly undefined superglobal array index: $_GET['calendly_status']. Check that the array index exists before using it.

WordPress.Security.ValidatedSanitizedInput.InputNotValidated
ERRORMaintainabilitydate date17
Category
Maintainability
Occurrences
17
Severity
error

Sample message

date() is affected by runtime timezone changes which can cause date/time to be incorrectly displayed. Use gmdate() instead.

WordPress.DateTime.RestrictedFunctions.date_date
ERRORMaintainabilityNon Enqueued Script15
Category
Maintainability
Occurrences
15
Severity
error

Sample message

Scripts must be registered/enqueued via wp_enqueue_script()

WordPress.WP.EnqueuedResources.NonEnqueuedScript
ERRORSecurityDatabase parameter is not escaped14
Category
Security
Occurrences
14
Severity
error

Sample message

Unescaped parameter $browser_table used in $wpdb->get_results()\n$browser_table assigned unsafely at line 1835.

PluginCheck.Security.DirectDB.UnescapedDBParameter
ERRORMaintainabilityblock api version too low14
Category
Maintainability
Occurrences
14
Severity
error

Sample message

Editor blocks must define "apiVersion" 3 or higher in block.json for WordPress 7.0+ iframe editor compatibility.

block_api_version_too_lowReference
ERRORSecurityException output is not escaped13
Category
Security
Occurrences
13
Severity
error

Sample message

All output should be run through an escaping function (see the Security sections in the WordPress Developer Handbooks), found '"Cannot register '{$prefix}'. The requested base directory does not exist!'"'.

WordPress.Security.EscapeOutput.ExceptionNotEscapedReference
ERRORSecuritySQL query is not prepared10
Category
Security
Occurrences
10
Severity
error

Sample message

Use placeholders and $wpdb->prepare(); found $additions

WordPress.DB.PreparedSQL.NotPrepared
ERRORMaintainabilityrand rand10
Category
Maintainability
Occurrences
10
Severity
error

Sample message

rand() is discouraged. Use the far less predictable wp_rand() instead.

WordPress.WP.AlternativeFunctions.rand_rand
ERRORI18nText Domain Mismatch10
Category
I18n
Occurrences
10
Severity
error

Sample message

Mismatched text domain. Expected 'embedpress' but got "embedpress-pro".

WordPress.WP.I18n.TextDomainMismatchReference

External Connections

Potential connections found in static code analysis.

84 domains

Outbound calls

268

External assets

9

Incoming endpoints

23

Notable Domains

wpdeveloper.com24 · outbound
calendly.com6 · outbound
api.calendly.com5 · outbound
facebook.com4 · outbound
cdn.amcharts.com3 · outbound
graph.facebook.com3 · outbound

Platform / Reference Domains

w3.org39 · platform/reference
wordpress.org3 · platform/reference

External Asset Domains

embedpress.com62 · asset + outbound
youtube.com7 · asset + outbound
cdn.ampproject.org2 · asset
dailymotion.com2 · asset + outbound
fast.wistia.net2 · asset
embed.twitch.tv1 · asset

Incoming Endpoints

/wp-json/embedpress/v1/oembed/(?P<provider>[a-zA-Z0-9\-]+)REST

register_rest_route

/wp-json/embedpress/v1/dynamic-fieldsREST

register_rest_route

/wp-json/embedpress/v1/dynamic-resolveREST

register_rest_route

/wp-json/embedpress/v1/send-feedbackREST

register_rest_route

/wp-json/embedpress/v1/youtube-playlist-itemsREST

register_rest_route

wp_ajax_nopriv_embedpress_do_ajax_requestpublic

wp_ajax

Admin AJAX endpoints14
wp_ajax_embedpress_notice_dismissauthenticated

wp_ajax

wp_ajax_delete_instagram_accountauthenticated

wp_ajax

wp_ajax_embedpress_dismiss_elementauthenticated

wp_ajax

wp_ajax_embedpress_dismiss_feature_noticeauthenticated

wp_ajax

wp_ajax_embedpress_do_ajax_requestauthenticated

wp_ajax

wp_ajax_embedpress_elements_actionauthenticated

wp_ajax

wp_ajax_embedpress_get_embed_url_infoauthenticated

wp_ajax

wp_ajax_embedpress_save_onboardingauthenticated

wp_ajax

wp_ajax_embedpress_settings_actionauthenticated

wp_ajax

wp_ajax_ep_generate_pdf_thumbnailauthenticated

wp_ajax

wp_ajax_ep_upload_pdf_thumbnailauthenticated

wp_ajax

wp_ajax_get_instagram_userdata_ajaxauthenticated

wp_ajax

2 more hidden

Score History

2 score snapshots

+0
1007550250Jun 20, 2026, 12:07 AM UTC Score 24/100 Plugin v4.5.5 Plugin Check 2.0.0 668 errors, 1,560 warningsJun 24, 2026, 10:57 AM UTC Score 24/100 Plugin v4.5.6 Plugin Check 2.0.0 669 errors, 1,550 warningsJun 20, 2026Jun 24, 2026

v4.5.6

24

Latest

Findings
2,219
Errors
669
Warnings
1,550
Check
2.0.0

v4.5.5

24

Score

Findings
2,228
Errors
668
Warnings
1,560
Check
2.0.0

Relationship Map

Author, categories, issues, domains, and nearby plugins.

37 nodes

Related Plugins

Code Embed

10k+ active installs

100
Document Embedder – Embed PDFs, Word, Excel, and Other Files

9k+ active installs

100
Embed YouTube Block – Fast Loading Videos, Shorts & Playlists

6k+ active installs

100
PDF Embed Block – Embed PDF Files in Posts or Pages

4k+ active installs

100
PDF Poster – Display PDF Files with Custom Viewer

20k+ active installs

100
CanadaHelps Embedded Donation Form

400 active installs

99