User Registration & Membership – Free & Paid Memberships, Subscriptions, Content Restriction, User Profile, Custom User Registration & Login Builder

Build membership sites with tiered plans, content restriction, drag-&-drop custom registration & login form builder, and built-in payment system.

v5.2.2wpeverestUpdated Added 60k+ installs96% rating73% support resolved
24
Score
664
Errors
3,318
Warnings
+0
Change

Category Scores

Security0
Repo91
Performance100
Maintainability0

Issues to Review

Prioritized issue groups from the latest Plugin Check scan

3,982 findings

Maintainability

2,387

13 issue groups

Security

1,245

9 issue groups

I18n

150

3 issue groups

WARNINGMaintainabilityNon-prefixed global variableGlobal variables defined by a theme/plugin should start with the theme/plugin prefix. Found: "$action_message".1,244
Category
Maintainability
Occurrences
1,244
Severity
warning

Sample message

Global variables defined by a theme/plugin should start with the theme/plugin prefix. Found: "$action_message".

WARNINGSecurityNonce verification recommendedProcessing form data without nonce verification.445
Category
Security
Occurrences
445
Severity
warning

Sample message

Processing form data without nonce verification.

WARNINGMaintainabilityNon-prefixed functionFunctions declared in the global namespace by a theme/plugin should start with the theme/plugin prefix. Found: "UR".332
Category
Maintainability
Occurrences
332
Severity
warning

Sample message

Functions declared in the global namespace by a theme/plugin should start with the theme/plugin prefix. Found: "UR".

WARNINGMaintainabilityNon-prefixed hook nameHook names invoked by a theme/plugin should start with the theme/plugin prefix. Found: "'ur_user_' . $action_label".240
Category
Maintainability
Occurrences
240
Severity
warning

Sample message

Hook names invoked by a theme/plugin should start with the theme/plugin prefix. Found: "'ur_user_' . $action_label".

ERRORSecurityOutput is not escapedAll output should be run through an escaping function (see the Security sections in the WordPress Developer Handbooks), found '" data-wp-lists='list:$singular'"'.222
Category
Security
Occurrences
222
Severity
error

Sample message

All output should be run through an escaping function (see the Security sections in the WordPress Developer Handbooks), found '" data-wp-lists='list:$singular'"'.

WARNINGSecurityMissing nonce verificationProcessing form data without nonce verification.203
Category
Security
Occurrences
203
Severity
warning

Sample message

Processing form data without nonce verification.

WARNINGMaintainabilityNon-prefixed classClasses declared by a theme/plugin should start with the theme/plugin prefix. Found: "UR_AJAX".184
Category
Maintainability
Occurrences
184
Severity
warning

Sample message

Classes declared by a theme/plugin should start with the theme/plugin prefix. Found: "UR_AJAX".

WARNINGSecurityRequest data is not unslashed$_COOKIE['wp-resetpass-' . COOKIEHASH] not unslashed before sanitization. Use wp_unslash() or similar141
Category
Security
Occurrences
141
Severity
warning

Sample message

$_COOKIE['wp-resetpass-' . COOKIEHASH] not unslashed before sanitization. Use wp_unslash() or similar

WARNINGSecurityInput is not sanitizedDetected usage of a non-sanitized input variable: $_COOKIE['wp-resetpass-' . COOKIEHASH]127
Category
Security
Occurrences
127
Severity
warning

Sample message

Detected usage of a non-sanitized input variable: $_COOKIE['wp-resetpass-' . COOKIEHASH]

ERRORI18nMissing Translators CommentA function call to __() with texts containing placeholders was found, but was not accompanied by a "translators:" comment on the line above to clarify the meaning of the placeholders.82
Category
I18n
Occurrences
82
Severity
error

Sample message

A function call to __() with texts containing placeholders was found, but was not accompanied by a "translators:" comment on the line above to clarify the meaning of the placeholders.

Show 15 more
WARNINGMaintainabilityDirect Query77
Category
Maintainability
Occurrences
77
Severity
warning

Sample message

Use of a direct database call is discouraged.

ERRORMaintainabilitydate date77
Category
Maintainability
Occurrences
77
Severity
error

Sample message

date() is affected by runtime timezone changes which can cause date/time to be incorrectly displayed. Use gmdate() instead.

WARNINGMaintainabilityNo Caching74
Category
Maintainability
Occurrences
74
Severity
warning

Sample message

Direct database call without caching detected. Consider using wp_cache_get() / wp_cache_set() or wp_cache_delete().

ERRORI18nNon Singular String Literal Text48
Category
I18n
Occurrences
48
Severity
error

Sample message

The $text parameter must be a single text string literal. Found: $completed ? '✓' : 'x'

ERRORMaintainabilityMissing direct file access protection46
Category
Maintainability
Occurrences
46
Severity
error

Sample message

PHP file should prevent direct access. Add a check like: if ( ! defined( 'ABSPATH' ) ) exit;

WARNINGSecurityInput is not validated45
Category
Security
Occurrences
45
Severity
warning

Sample message

Detected usage of a possibly undefined superglobal array index: $_GET['form_id']. Check that the array index exists before using it.

WARNINGMaintainabilityslow db query meta key26
Category
Maintainability
Occurrences
26
Severity
warning

Sample message

Detected usage of meta_key, possible slow query.

WARNINGMaintainabilityslow db query meta value26
Category
Maintainability
Occurrences
26
Severity
warning

Sample message

Detected usage of meta_value, possible slow query.

ERRORMaintainabilitycurl curl setopt23
Category
Maintainability
Occurrences
23
Severity
error

Sample message

Using cURL functions is highly discouraged. Use wp_remote_get() instead.

WARNINGSecurityInterpolated SQL is not prepared22
Category
Security
Occurrences
22
Severity
warning

Sample message

Use placeholders and $wpdb->prepare(); found interpolated variable $subscription_table at "SELECT COUNT(DISTINCT user_id) total from $subscription_table\n

WARNINGSecuritywp redirect wp redirect22
Category
Security
Occurrences
22
Severity
warning

Sample message

wp_redirect() found. Using wp_safe_redirect(), along with the "allowed_redirect_hosts" filter if needed, can help avoid any chances of malicious redirects within code. It is also important to remember to call exit() after a redirect so that no other unwanted code is executed.

ERRORI18nMissing Arg Domain20
Category
I18n
Occurrences
20
Severity
error

Sample message

Missing $domain parameter in function call to esc_attr__().

WARNINGMaintainabilityslow db query meta query19
Category
Maintainability
Occurrences
19
Severity
warning

Sample message

Detected usage of meta_query, possible slow query.

WARNINGMaintainabilityNon-prefixed constant19
Category
Maintainability
Occurrences
19
Severity
warning

Sample message

Global constants defined by a theme/plugin should start with the theme/plugin prefix. Found: "URM_CONTENT_DRIP_CSS_ASSETS_URL".

WARNINGSecurityDatabase parameter is not escaped18
Category
Security
Occurrences
18
Severity
warning

Sample message

Unescaped parameter $orders_meta_table used in $wpdb->get_var()\n$orders_meta_table assigned unsafely at line 393.

Score History

First score snapshot

v5.2.2

24

Latest

Findings
3,982
Errors
664
Warnings
3,318
Check
2.0.0

Related Plugins