This plugin lets you create custom image sizes for your site. Override your theme sizes directly on the Media settings page, regenerate thumbnails, an …
Category Scores
Top Issues by Category
security84
maintainability35
i18n6
repo_compliance2
supply_chain1
Issues Details
128 issues found in latest scan
All output should be run through an escaping function (like esc_html_e() or esc_attr_e()), found '_e'.
$_POST['customName'] not unslashed before sanitization. Use wp_unslash() or similar
Detected usage of a non-sanitized input variable: $_POST['nonce']
All output should be run through an escaping function (see the Security sections in the WordPress Developer Handbooks), found '$crop'.
Processing form data without nonce verification.
Hook names invoked by a theme/plugin should start with the theme/plugin prefix. Found: "SIS/Admin/Post/Display_Thumbnail_Regenerate".
Global variables defined by a theme/plugin should start with the theme/plugin prefix. Found: "$crop".
Global constants defined by a theme/plugin should start with the theme/plugin prefix. Found: "SIS_DIR".
Function "wp_add_inline_script()" requires WordPress 4.5.0, but your plugin minimum supported version is WordPress 3.5.0.
Processing form data without nonce verification.
The $text parameter must be a single text string literal. Found: 'custom_image_sizes[' . $args['name'] . '][h]'
Unescaped parameter $whichmimetype used in $wpdb->get_var()\n$whichmimetype assigned unsafely at line 647.
Direct database call without caching detected. Consider using wp_cache_get() / wp_cache_set() or wp_cache_delete().
Use placeholders and $wpdb->prepare(); found interpolated variable $whichmimetype at \t\t\t\t$whichmimetype\n
PHP file should prevent direct access. Add a check like: if ( ! defined( 'ABSPATH' ) ) exit;
Sanitization missing for register_setting().
Functions declared in the global namespace by a theme/plugin should start with the theme/plugin prefix. Found: "init_sis".
In footer ($in_footer) is not set explicitly wp_register_script; It is recommended to load scripts in the footer. Please set this value to `true` to load it in the footer, or explicitly `false` if it should be loaded in the header.
The "/vendor" directory using composer exists, but "composer.json" file is missing.
The "Short Description" section is missing. An excerpt was generated from your main plugin description.
One or more tags were ignored. Please limit your plugin to 5 tags.
| Code | Type | Message | Count |
|---|---|---|---|
| WordPress.Security.EscapeOutput.UnsafePrintingFunction | ERROR | All output should be run through an escaping function (like esc_html_e() or esc_attr_e()), found '_e'. | 24 |
| WordPress.Security.ValidatedSanitizedInput.MissingUnslash | WARNING | $_POST['customName'] not unslashed before sanitization. Use wp_unslash() or similar | 16 |
| WordPress.Security.ValidatedSanitizedInput.InputNotSanitized | WARNING | Detected usage of a non-sanitized input variable: $_POST['nonce'] | 13 |
| WordPress.Security.EscapeOutput.OutputNotEscaped | ERROR | All output should be run through an escaping function (see the Security sections in the WordPress Developer Handbooks), found '$crop'. | 11 |
| WordPress.Security.NonceVerification.Missing | WARNING | Processing form data without nonce verification. | 10 |
| WordPress.NamingConventions.PrefixAllGlobals.NonPrefixedHooknameFound | WARNING | Hook names invoked by a theme/plugin should start with the theme/plugin prefix. Found: "SIS/Admin/Post/Display_Thumbnail_Regenerate". | 9 |
| WordPress.NamingConventions.PrefixAllGlobals.NonPrefixedVariableFound | WARNING | Global variables defined by a theme/plugin should start with the theme/plugin prefix. Found: "$crop". | 7 |
| WordPress.NamingConventions.PrefixAllGlobals.NonPrefixedConstantFound | WARNING | Global constants defined by a theme/plugin should start with the theme/plugin prefix. Found: "SIS_DIR". | 6 |
| wp_function_not_compatible_with_requires_wp | ERROR | Function "wp_add_inline_script()" requires WordPress 4.5.0, but your plugin minimum supported version is WordPress 3.5.0. | 4 |
| WordPress.Security.NonceVerification.Recommended | WARNING | Processing form data without nonce verification. | 3 |
| WordPress.WP.I18n.MissingArgDomain | ERROR | Missing $domain parameter in function call to esc_attr_e(). | 3 |
| WordPress.WP.I18n.NonSingularStringLiteralText | ERROR | The $text parameter must be a single text string literal. Found: 'custom_image_sizes[' . $args['name'] . '][h]' | 3 |
| PluginCheck.Security.DirectDB.UnescapedDBParameter | ERROR | Unescaped parameter $whichmimetype used in $wpdb->get_var()\n$whichmimetype assigned unsafely at line 647. | 2 |
| WordPress.DB.DirectDatabaseQuery.DirectQuery | WARNING | Use of a direct database call is discouraged. | 2 |
| WordPress.DB.DirectDatabaseQuery.NoCaching | WARNING | Direct database call without caching detected. Consider using wp_cache_get() / wp_cache_set() or wp_cache_delete(). | 2 |
| WordPress.DB.PreparedSQL.InterpolatedNotPrepared | WARNING | Use placeholders and $wpdb->prepare(); found interpolated variable $whichmimetype at \t\t\t\t$whichmimetype\n | 2 |
| WordPress.DB.PreparedSQL.NotPrepared | ERROR | Use placeholders and $wpdb->prepare(); found $_POST | 2 |
| missing_direct_file_access_protection | ERROR | PHP file should prevent direct access. Add a check like: if ( ! defined( 'ABSPATH' ) ) exit; | 2 |
| PluginCheck.CodeAnalysis.SettingSanitization.register_settingMissing | ERROR | Sanitization missing for register_setting(). | 1 |
| WordPress.NamingConventions.PrefixAllGlobals.NonPrefixedFunctionFound | WARNING | Functions declared in the global namespace by a theme/plugin should start with the theme/plugin prefix. Found: "init_sis". | 1 |
| WordPress.WP.EnqueuedResourceParameters.NotInFooter | WARNING | In footer ($in_footer) is not set explicitly wp_register_script; It is recommended to load scripts in the footer. Please set this value to `true` to load it in the footer, or explicitly `false` if it should be loaded in the header. | 1 |
| hidden_files | ERROR | Hidden files are not permitted. | 1 |
| missing_composer_json_file | WARNING | The "/vendor" directory using composer exists, but "composer.json" file is missing. | 1 |
| readme_parser_warnings_no_short_description_present | WARNING | The "Short Description" section is missing. An excerpt was generated from your main plugin description. | 1 |
| readme_parser_warnings_too_many_tags | WARNING | One or more tags were ignored. Please limit your plugin to 5 tags. | 1 |
Latest Snapshot
Findings
128
Errors
53
Warnings
75
Score History
First score snapshot
First scan completed Jun 20, 2026
v3.2.5 · Plugin Check 2.0.0 · Model 2026.06-mvp-static-v2
Jun 20, 2026
v3.2.5
35
Latest
- Findings
- 128
- Errors
- 53
- Warnings
- 75
- Plugin Check
- 2.0.0
- Model
- 2026.06-mvp-static-v2
| Scan | Score | Findings | Errors | Warnings | Plugin | Plugin Check | Model |
|---|---|---|---|---|---|---|---|
| Jun 20, 2026Latest | 35 | 128 | 53 | 75 | v3.2.5 | 2.0.0 | 2026.06-mvp-static-v2 |
