Brevo – Email, SMS, Web Push, Chat, and more.

$_COOKIE['email_id'] not unslashed before sanitization. Use wp_unslash() or similar

Use placeholders and $wpdb->prepare(); found $alter_query

PHP file should prevent direct access. Add a check like: if ( ! defined( 'ABSPATH' ) ) exit;

Global variables defined by a theme/plugin should start with the theme/plugin prefix. Found: "$attachment".

All output should be run through an escaping function (see the Security sections in the WordPress Developer Handbooks), found '" git push origin master gh-pages v$newVersion\n"'.

Processing form data without nonce verification.

Use of a direct database call is discouraged.

Direct database call without caching detected. Consider using wp_cache_get() / wp_cache_set() or wp_cache_delete().

Processing form data without nonce verification.

Detected usage of a non-sanitized input variable: $_COOKIE[SIB_Push_Public::INSTALLATION_ID_COOKIE_NAME]

Unescaped parameter $alter_query used in $wpdb->query()\n$alter_query assigned unsafely at line 102.

Classes declared by a theme/plugin should start with the theme/plugin prefix. Found: "Mailin".

Detected usage of a possibly undefined superglobal array index: $_FILES['image']. Check that the array index exists before using it.

Hook names invoked by a theme/plugin should start with the theme/plugin prefix. Found: "active_plugins".

The use of function passthru() is forbidden

error_log() found. Debug code should not normally be used in production.

All output should be run through an escaping function (like esc_html_e() or esc_attr_e()), found '_e'.

Detected usage of a non-sanitized, non-validated input variable _SERVER: "://$_SERVER[HTTP_HOST]$_SERVER[REQUEST_URI]"

Using cURL functions is highly discouraged. Use wp_remote_get() instead.

parse_url() is discouraged because of inconsistency in the output across PHP versions; use wp_parse_url() instead.

Scripts must be registered/enqueued via wp_enqueue_script()

Use of heredoc syntax (<<<) is not allowed; use standard strings or inline HTML instead

In footer ($in_footer) is not set explicitly wp_register_script; It is recommended to load scripts in the footer. Please set this value to `true` to load it in the footer, or explicitly `false` if it should be loaded in the header.

Hidden files are not permitted.

Function "str_contains()" requires WordPress 5.9.0, but your plugin minimum supported version is WordPress 4.4.0.