Duplicate pages, posts, and custom post types with one click. Create templates, preserve content states, and speed up workflows.
Category Scores
Top Issues by Category
i18n31
security31
maintainability30
supply_chain1
repo_compliance1
Issues Details
94 issues found in latest scan
Mismatched text domain. Expected 'wp-duplicate-page' but got 'filebird'.
$_GET['post'] not unslashed before sanitization. Use wp_unslash() or similar
Global variables defined by a theme/plugin should start with the theme/plugin prefix. Found: "$displayName".
All output should be run through an escaping function (see the Security sections in the WordPress Developer Handbooks), found '$reviewedText'.
Detected usage of a non-sanitized input variable: $_POST['njtDuplicateInEditor']
Classes declared by a theme/plugin should start with the theme/plugin prefix. Found: "FBDashboardWidgetMain".
Processing form data without nonce verification.
The plugin name includes a restricted term. Your chosen plugin name - "WP Duplicate Page" - contains the restricted term "wp" which cannot be used at all in your plugin name.
error_log() found. Debug code should not normally be used in production.
The $text text string should have translatable content. Found: ' %s '
Function "determine_locale()" requires WordPress 5.0.0, but your plugin minimum supported version is WordPress 4.0.0.
Offloading images, js, css, and other scripts to your servers or any remote service is disallowed.
Global constants defined by a theme/plugin should start with the theme/plugin prefix. Found: "YAY_CROSS_MODULES_REGISTRY_VERSION".
Hook names invoked by a theme/plugin should start with the theme/plugin prefix. Found: "wp_duplicate_page_exclude_meta_key".
Processing form data without nonce verification.
wp_reset_query() is discouraged. Use wp_reset_postdata() instead.
A function call to __() with texts containing placeholders was found, but was not accompanied by a "translators:" comment on the line above to clarify the meaning of the placeholders.
Missing "License" in Plugin Header. Please update your Plugin Header with a valid GPLv2 (or later) compatible license.
| Code | Type | Message | Count |
|---|---|---|---|
| WordPress.WP.I18n.TextDomainMismatch | ERROR | Mismatched text domain. Expected 'wp-duplicate-page' but got 'filebird'. | 28 |
| WordPress.Security.ValidatedSanitizedInput.MissingUnslash | WARNING | $_GET['post'] not unslashed before sanitization. Use wp_unslash() or similar | 13 |
| WordPress.NamingConventions.PrefixAllGlobals.NonPrefixedVariableFound | WARNING | Global variables defined by a theme/plugin should start with the theme/plugin prefix. Found: "$displayName". | 12 |
| WordPress.Security.EscapeOutput.OutputNotEscaped | ERROR | All output should be run through an escaping function (see the Security sections in the WordPress Developer Handbooks), found '$reviewedText'. | 6 |
| WordPress.Security.ValidatedSanitizedInput.InputNotSanitized | WARNING | Detected usage of a non-sanitized input variable: $_POST['njtDuplicateInEditor'] | 6 |
| WordPress.NamingConventions.PrefixAllGlobals.NonPrefixedClassFound | WARNING | Classes declared by a theme/plugin should start with the theme/plugin prefix. Found: "FBDashboardWidgetMain". | 5 |
| WordPress.Security.NonceVerification.Recommended | WARNING | Processing form data without nonce verification. | 5 |
| trademarked_term | WARNING | The plugin name includes a restricted term. Your chosen plugin name - "WP Duplicate Page" - contains the restricted term "wp" which cannot be used at all in your plugin name. | 3 |
| WordPress.PHP.DevelopmentFunctions.error_log_error_log | WARNING | error_log() found. Debug code should not normally be used in production. | 2 |
| WordPress.WP.I18n.NoEmptyStrings | ERROR | The $text text string should have translatable content. Found: ' %s ' | 2 |
| five_star_reviews_detected | ERROR | Linking directly to 5 stars reviews is not allowed. | 2 |
| wp_function_not_compatible_with_requires_wp | ERROR | Function "determine_locale()" requires WordPress 5.0.0, but your plugin minimum supported version is WordPress 4.0.0. | 2 |
| PluginCheck.CodeAnalysis.Offloading.OffloadedContent | ERROR | Offloading images, js, css, and other scripts to your servers or any remote service is disallowed. | 1 |
| WordPress.NamingConventions.PrefixAllGlobals.NonPrefixedConstantFound | WARNING | Global constants defined by a theme/plugin should start with the theme/plugin prefix. Found: "YAY_CROSS_MODULES_REGISTRY_VERSION". | 1 |
| WordPress.NamingConventions.PrefixAllGlobals.NonPrefixedHooknameFound | WARNING | Hook names invoked by a theme/plugin should start with the theme/plugin prefix. Found: "wp_duplicate_page_exclude_meta_key". | 1 |
| WordPress.Security.NonceVerification.Missing | WARNING | Processing form data without nonce verification. | 1 |
| WordPress.WP.DiscouragedFunctions.wp_reset_query_wp_reset_query | WARNING | wp_reset_query() is discouraged. Use wp_reset_postdata() instead. | 1 |
| WordPress.WP.I18n.MissingTranslatorsComment | ERROR | A function call to __() with texts containing placeholders was found, but was not accompanied by a "translators:" comment on the line above to clarify the meaning of the placeholders. | 1 |
| hidden_files | ERROR | Hidden files are not permitted. | 1 |
| plugin_header_no_license | ERROR | Missing "License" in Plugin Header. Please update your Plugin Header with a valid GPLv2 (or later) compatible license. | 1 |
Latest Snapshot
Findings
94
Errors
44
Warnings
50
Score History
First score snapshot
First scan completed Jun 20, 2026
v1.8.4 · Plugin Check 2.0.0 · Model 2026.06-mvp-static-v2
Jun 20, 2026
v1.8.4
35
Latest
- Findings
- 94
- Errors
- 44
- Warnings
- 50
- Plugin Check
- 2.0.0
- Model
- 2026.06-mvp-static-v2
| Scan | Score | Findings | Errors | Warnings | Plugin | Plugin Check | Model |
|---|---|---|---|---|---|---|---|
| Jun 20, 2026Latest | 35 | 94 | 44 | 50 | v1.8.4 | 2.0.0 | 2026.06-mvp-static-v2 |
