Easy, simple setup to add a PayPal Donation button as a Widget or with a shortcode.
Category Scores
Top Issues by Category
security88
i18n49
maintainability22
Issues Details
160 issues found in latest scan
All output should be run through an escaping function (see the Security sections in the WordPress Developer Handbooks), found '"'><input style='padding: 10px 0 10px 0;' type='radio' name='{$optionKey}[button]' value='"'.
The $domain parameter must be a single text string literal. Found: PayPalDonations::TEXT_DOMAIN
Global variables defined by a theme/plugin should start with the theme/plugin prefix. Found: "$button_localized".
All output should be run through an escaping function (like esc_html_e() or esc_attr_e()), found '_e'.
PHP file should prevent direct access. Add a check like: if ( ! defined( 'ABSPATH' ) ) exit;
A function call to __() with texts containing placeholders was found, but was not accompanied by a "translators:" comment on the line above to clarify the meaning of the placeholders.
Functions declared in the global namespace by a theme/plugin should start with the theme/plugin prefix. Found: "pp_donations_ipn_listener".
strip_tags() is discouraged. Use the more comprehensive wp_strip_all_tags() instead.
Hook names invoked by a theme/plugin should start with the theme/plugin prefix. Found: "pd_button_localized_value".
Processing form data without nonce verification.
load_plugin_textdomain() has been discouraged since WordPress version 4.6. When your plugin is hosted on WordPress.org, you no longer need to manually include this function call for translations under your plugin slug. WordPress will automatically load the translations for you as needed.
Offloading images, js, css, and other scripts to your servers or any remote service is disallowed.
Sanitization missing for register_setting().
One or more tags were ignored. Please limit your plugin to 5 tags.
The plugin slug includes a restricted term. Your plugin slug - "paypal-donations" - contains the restricted term "paypal" and cannot be used to begin your plugin slug. We disallow the use of certain terms in ways that are abused, or potentially infringe on and/or are misleading with regards to trademarks. You may use the term "paypal" elsewhere in your plugin slug, such as "... for paypal".
| Code | Type | Message | Count |
|---|---|---|---|
| WordPress.Security.EscapeOutput.OutputNotEscaped | ERROR | All output should be run through an escaping function (see the Security sections in the WordPress Developer Handbooks), found '"'><input style='padding: 10px 0 10px 0;' type='radio' name='{$optionKey}[button]' value='"'. | 79 |
| WordPress.WP.I18n.NonSingularStringLiteralDomain | ERROR | The $domain parameter must be a single text string literal. Found: PayPalDonations::TEXT_DOMAIN | 44 |
| WordPress.NamingConventions.PrefixAllGlobals.NonPrefixedVariableFound | WARNING | Global variables defined by a theme/plugin should start with the theme/plugin prefix. Found: "$button_localized". | 7 |
| WordPress.Security.EscapeOutput.UnsafePrintingFunction | ERROR | All output should be run through an escaping function (like esc_html_e() or esc_attr_e()), found '_e'. | 6 |
| missing_direct_file_access_protection | ERROR | PHP file should prevent direct access. Add a check like: if ( ! defined( 'ABSPATH' ) ) exit; | 5 |
| WordPress.WP.I18n.MissingTranslatorsComment | ERROR | A function call to __() with texts containing placeholders was found, but was not accompanied by a "translators:" comment on the line above to clarify the meaning of the placeholders. | 4 |
| WordPress.NamingConventions.PrefixAllGlobals.NonPrefixedFunctionFound | WARNING | Functions declared in the global namespace by a theme/plugin should start with the theme/plugin prefix. Found: "pp_donations_ipn_listener". | 3 |
| WordPress.WP.AlternativeFunctions.strip_tags_strip_tags | ERROR | strip_tags() is discouraged. Use the more comprehensive wp_strip_all_tags() instead. | 3 |
| WordPress.NamingConventions.PrefixAllGlobals.NonPrefixedHooknameFound | WARNING | Hook names invoked by a theme/plugin should start with the theme/plugin prefix. Found: "pd_button_localized_value". | 2 |
| WordPress.Security.NonceVerification.Recommended | WARNING | Processing form data without nonce verification. | 2 |
| PluginCheck.CodeAnalysis.DiscouragedFunctions.load_plugin_textdomainFound | WARNING | load_plugin_textdomain() has been discouraged since WordPress version 4.6. When your plugin is hosted on WordPress.org, you no longer need to manually include this function call for translations under your plugin slug. WordPress will automatically load the translations for you as needed. | 1 |
| PluginCheck.CodeAnalysis.Offloading.OffloadedContent | ERROR | Offloading images, js, css, and other scripts to your servers or any remote service is disallowed. | 1 |
| PluginCheck.CodeAnalysis.SettingSanitization.register_settingMissing | ERROR | Sanitization missing for register_setting(). | 1 |
| readme_parser_warnings_too_many_tags | WARNING | One or more tags were ignored. Please limit your plugin to 5 tags. | 1 |
| trademarked_term | WARNING | The plugin slug includes a restricted term. Your plugin slug - "paypal-donations" - contains the restricted term "paypal" and cannot be used to begin your plugin slug. We disallow the use of certain terms in ways that are abused, or potentially infringe on and/or are misleading with regards to trademarks. You may use the term "paypal" elsewhere in your plugin slug, such as "... for paypal". | 1 |
Latest Snapshot
Findings
160
Errors
143
Warnings
17
Score History
First score snapshot
First scan completed
v1.9.11 · Plugin Check 2.0.0 · Model 2026.06-mvp-static-v2
v1.9.11
40
Latest
- Findings
- 160
- Errors
- 143
- Warnings
- 17
- Plugin Check
- 2.0.0
- Model
- 2026.06-mvp-static-v2
| Scan | Score | Findings | Errors | Warnings | Plugin | Plugin Check | Model |
|---|---|---|---|---|---|---|---|
| Latest | 40 | 160 | 143 | 17 | v1.9.11 | 2.0.0 | 2026.06-mvp-static-v2 |
