Nexter Extension – Security, Performance, Code Snippets & Site Toolkit

Processing form data without nonce verification.

Hook names invoked by a theme/plugin should start with the theme/plugin prefix. Found: "active_plugins".

Global variables defined by a theme/plugin should start with the theme/plugin prefix. Found: "$body".

Functions declared in the global namespace by a theme/plugin should start with the theme/plugin prefix. Found: "get_nexter_header_sections".

Detected usage of a non-sanitized input variable: $_FILES['snippet_file']['name']

All output should be run through an escaping function (see the Security sections in the WordPress Developer Handbooks), found '"<style data-template-id=\"{$post_id}\" id=\"bricks-inline-css-template-{$post_id}\">{$template_inline_css}</style>"'.

Processing form data without nonce verification.

Function "str_contains()" requires WordPress 5.9.0, but your plugin minimum supported version is WordPress 5.0.0.

$_GET[&#039;current_version&#039;] not unslashed before sanitization. Use wp_unslash() or similar

error_log() found. Debug code should not normally be used in production.

Classes declared by a theme/plugin should start with the theme/plugin prefix. Found: &quot;NxtExt_Rollback&quot;.

Use of a direct database call is discouraged.

Direct database call without caching detected. Consider using wp_cache_get() / wp_cache_set() or wp_cache_delete().

unlink() is discouraged. Use wp_delete_file() to delete a file.

error_reporting() can lead to full path disclosure.

The use of function ini_set() is discouraged

File operations should use WP_Filesystem methods instead of direct PHP filesystem calls. Found: is_writable().

Plugin folders are deleted when upgraded. Do not save data to the plugin folder using copy(). Detected usage of constant WP_CONTENT_DIR. Use wp_upload_dir() to get the uploads directory path or save to the database instead.

PHP file should prevent direct access. Add a check like: if ( ! defined( 'ABSPATH' ) ) exit;

Use placeholders and $wpdb-&gt;prepare(); found interpolated variable $table at &quot;SELECT * FROM `$table` WHERE `ip_address` = %s&quot;

set_error_handler() found. Debug code should not normally be used in production.

The use of function eval() is forbidden

All output should be run through an escaping function (see the Security sections in the WordPress Developer Handbooks), found '$e'.

Unescaped parameter $sql3 used in $wpdb-&gt;get_results()\n$sql3 assigned unsafely at line 1210.

Detected usage of a possibly undefined superglobal array index: $_FILES[&#039;snippet_file&#039;][&#039;error&#039;]. Check that the array index exists before using it.