Plausible Analytics is a privacy-friendly web analytics plugin for WordPress that is an easy-to-use, lightweight and more accurate alternative to Goo …
Category Scores
Issues to Review
Prioritized issue groups from the latest Plugin Check scan
Security
278
8 issue groups
I18n
42
5 issue groups
Maintainability
23
11 issue groups
Supply Chain
2
1 issue group
ERRORSecurityException output is not escapedAll output should be run through an escaping function (see the Security sections in the WordPress Developer Handbooks), found '"$name not found on class"'.170
- Category
- Security
- Occurrences
- 170
- Severity
- error
Sample message
All output should be run through an escaping function (see the Security sections in the WordPress Developer Handbooks), found '"$name not found on class"'.
ERRORSecurityOutput is not escapedAll output should be run through an escaping function (see the Security sections in the WordPress Developer Handbooks), found '"<meta name='plausible-analytics-version' content='$version' />\n"'.49
- Category
- Security
- Occurrences
- 49
- Severity
- error
Sample message
All output should be run through an escaping function (see the Security sections in the WordPress Developer Handbooks), found '"<meta name='plausible-analytics-version' content='$version' />\n"'.
ERRORI18nMissing Translators CommentA function call to __() with texts containing placeholders was found, but was not accompanied by a "translators:" comment on the line above to clarify the meaning of the placeholders.27
- Category
- I18n
- Occurrences
- 27
- Severity
- error
Sample message
A function call to __() with texts containing placeholders was found, but was not accompanied by a "translators:" comment on the line above to clarify the meaning of the placeholders.
WARNINGSecurityNonce verification recommendedProcessing form data without nonce verification.24
- Category
- Security
- Occurrences
- 24
- Severity
- warning
Sample message
Processing form data without nonce verification.
WARNINGSecurityRequest data is not unslashed$_GET['page-url'] not unslashed before sanitization. Use wp_unslash() or similar11
- Category
- Security
- Occurrences
- 11
- Severity
- warning
Sample message
$_GET['page-url'] not unslashed before sanitization. Use wp_unslash() or similar
WARNINGSecurityMissing nonce verificationProcessing form data without nonce verification.9
- Category
- Security
- Occurrences
- 9
- Severity
- warning
Sample message
Processing form data without nonce verification.
WARNINGSecurityInput is not sanitizedDetected usage of a non-sanitized input variable: $_GET['page-url']9
- Category
- Security
- Occurrences
- 9
- Severity
- warning
Sample message
Detected usage of a non-sanitized input variable: $_GET['page-url']
ERRORI18nNon Singular String Literal TextThe $text parameter must be a single text string literal. Found: $field['label']8
- Category
- I18n
- Occurrences
- 8
- Severity
- error
Sample message
The $text parameter must be a single text string literal. Found: $field['label']
ERRORI18nUnordered Placeholders TextMultiple placeholders in translatable strings should be ordered. Expected "%1$s, %2$s", but got "%s, %s" in '<p><a href="%s" target="_blank">Plausible Analytics</a> is an easy to use, open source, lightweight and privacy-friendly alternative to Google Analytics. We\'re super excited to have you on board!</p><p>To use our plugin, you need to <a href="%s" target="_blank">register an account</a>. To explore the product, we offer you a free 30-day trial. No credit card is required to sign up for the trial.</p><p>Already have an account? Please do follow the following steps to get the most out of your Plausible experience.</p>'.5
- Category
- I18n
- Occurrences
- 5
- Severity
- error
Sample message
Multiple placeholders in translatable strings should be ordered. Expected "%1$s, %2$s", but got "%s, %s" in '<p><a href="%s" target="_blank">Plausible Analytics</a> is an easy to use, open source, lightweight and privacy-friendly alternative to Google Analytics. We\'re super excited to have you on board!</p><p>To use our plugin, you need to <a href="%s" target="_blank">register an account</a>. To explore the product, we offer you a free 30-day trial. No credit card is required to sign up for the trial.</p><p>Already have an account? Please do follow the following steps to get the most out of your Plausible experience.</p>'.
ERRORMaintainabilityMissing direct file access protectionPHP file should prevent direct access. Add a check like: if ( ! defined( 'ABSPATH' ) ) exit;5
- Category
- Maintainability
- Occurrences
- 5
- Severity
- error
Sample message
PHP file should prevent direct access. Add a check like: if ( ! defined( 'ABSPATH' ) ) exit;
Show 15 moreShow less
WARNINGSecurityInput is not validated4
- Category
- Security
- Occurrences
- 4
- Severity
- warning
Sample message
Detected usage of a possibly undefined superglobal array index: $_POST['_wpcf7_container_post']. Check that the array index exists before using it.
ERRORMaintainabilityunlink unlink4
- Category
- Maintainability
- Occurrences
- 4
- Severity
- error
Sample message
unlink() is discouraged. Use wp_delete_file() to delete a file.
WARNINGMaintainabilityNot In Footer3
- Category
- Maintainability
- Occurrences
- 3
- Severity
- warning
Sample message
In footer ($in_footer) is not set explicitly wp_enqueue_script; It is recommended to load scripts in the footer. Please set this value to `true` to load it in the footer, or explicitly `false` if it should be loaded in the header.
WARNINGSecuritywp redirect wp redirect2
- Category
- Security
- Occurrences
- 2
- Severity
- warning
Sample message
wp_redirect() found. Using wp_safe_redirect(), along with the "allowed_redirect_hosts" filter if needed, can help avoid any chances of malicious redirects within code. It is also important to remember to call exit() after a redirect so that no other unwanted code is executed.
ERRORMaintainabilityfile system operations fopen2
- Category
- Maintainability
- Occurrences
- 2
- Severity
- error
Sample message
File operations should use WP_Filesystem methods instead of direct PHP filesystem calls. Found: fopen().
ERRORMaintainabilityfile system operations rmdir2
- Category
- Maintainability
- Occurrences
- 2
- Severity
- error
Sample message
File operations should use WP_Filesystem methods instead of direct PHP filesystem calls. Found: rmdir().
ERRORMaintainabilityparse url parse url2
- Category
- Maintainability
- Occurrences
- 2
- Severity
- error
Sample message
parse_url() is discouraged because of inconsistency in the output across PHP versions; use wp_parse_url() instead.
ERRORSupply ChainHidden files included2
- Category
- Supply Chain
- Occurrences
- 2
- Severity
- error
Sample message
Hidden files are not permitted.
WARNINGI18nDiscouraged text-domain loading1
- Category
- I18n
- Occurrences
- 1
- Severity
- warning
Sample message
load_plugin_textdomain() has been discouraged since WordPress version 4.6. When your plugin is hosted on WordPress.org, you no longer need to manually include this function call for translations under your plugin slug. WordPress will automatically load the translations for you as needed.
WARNINGMaintainabilityNon-prefixed global variable1
- Category
- Maintainability
- Occurrences
- 1
- Severity
- warning
Sample message
Global variables defined by a theme/plugin should start with the theme/plugin prefix. Found: "$uninstaller".
ERRORMaintainabilityfile system operations fclose1
- Category
- Maintainability
- Occurrences
- 1
- Severity
- error
Sample message
File operations should use WP_Filesystem methods instead of direct PHP filesystem calls. Found: fclose().
ERRORMaintainabilityfile system operations fwrite1
- Category
- Maintainability
- Occurrences
- 1
- Severity
- error
Sample message
File operations should use WP_Filesystem methods instead of direct PHP filesystem calls. Found: fwrite().
WARNINGMaintainabilityMissing Version1
- Category
- Maintainability
- Occurrences
- 1
- Severity
- warning
Sample message
Resource version not set in call to wp_register_script(). This means new versions of the script may not always be loaded due to browser caching.
ERRORMaintainabilityNon Enqueued Script1
- Category
- Maintainability
- Occurrences
- 1
- Severity
- error
Sample message
Scripts must be registered/enqueued via wp_enqueue_script()
ERRORI18nNon Singular String Literal Context1
- Category
- I18n
- Occurrences
- 1
- Severity
- error
Sample message
The $context parameter must be a single text string literal. Found: __( 'Value when user is not logged in.', 'plausible-analytics' )
Score History
First score snapshot
v2.5.7
33
Latest
- Findings
- 351
- Errors
- 284
- Warnings
- 67
- Check
- 2.0.0
| Scan | Score | Findings | Errors | Warnings | Plugin | Check |
|---|---|---|---|---|---|---|
| Latest | 33 | 351 | 284 | 67 | v2.5.7 | 2.0.0 |
Related Plugins
0 active installs
7k+ active installs
3k+ active installs
10k+ active installs
100k+ active installs
10k+ active installs