SlimStat Analytics

Real-time WordPress analytics that stay on your own server: pageviews, outbound links, WooCommerce funnels, all privacy-first and GDPR-ready.

v5.5.0VeronaLabsUpdated Added 70k+ installs96% rating100% support resolved
25
Score
1,177
Errors
870
Warnings
+1
Change

Category Scores

Security0
Repo100
Performance100
Maintainability0

Issues to Review

Prioritized issue groups from the latest Plugin Check scan

2,047 findings

Security

1,154

12 issue groups

Maintainability

714

12 issue groups

I18n

44

1 issue group

ERRORSecurityException output is not escapedAll output should be run through an escaping function (see the Security sections in the WordPress Developer Handbooks), found '"($statusCode) for $service"'.523
Category
Security
Occurrences
523
Severity
error

Sample message

All output should be run through an escaping function (see the Security sections in the WordPress Developer Handbooks), found '"($statusCode) for $service"'.

WARNINGMaintainabilityNon-prefixed global variableGlobal variables defined by a theme/plugin should start with the theme/plugin prefix. Found: "$a_addon".374
Category
Maintainability
Occurrences
374
Severity
warning

Sample message

Global variables defined by a theme/plugin should start with the theme/plugin prefix. Found: "$a_addon".

ERRORSecurityOutput is not escapedAll output should be run through an escaping function (see the Security sections in the WordPress Developer Handbooks), found '"'>\n'.189
Category
Security
Occurrences
189
Severity
error

Sample message

All output should be run through an escaping function (see the Security sections in the WordPress Developer Handbooks), found '"'>\n'.

ERRORSecuritySQL query is not preparedUse placeholders and $wpdb->prepare(); found $GLOBALS112
Category
Security
Occurrences
112
Severity
error

Sample message

Use placeholders and $wpdb->prepare(); found $GLOBALS

WARNINGSecurityRequest data is not unslashed$_COOKIE['comment_author_' . COOKIEHASH] not unslashed before sanitization. Use wp_unslash() or similar69
Category
Security
Occurrences
69
Severity
warning

Sample message

$_COOKIE['comment_author_' . COOKIEHASH] not unslashed before sanitization. Use wp_unslash() or similar

WARNINGMaintainabilityDirect QueryUse of a direct database call is discouraged.66
Category
Maintainability
Occurrences
66
Severity
warning

Sample message

Use of a direct database call is discouraged.

WARNINGMaintainabilityNo CachingDirect database call without caching detected. Consider using wp_cache_get() / wp_cache_set() or wp_cache_delete().66
Category
Maintainability
Occurrences
66
Severity
warning

Sample message

Direct database call without caching detected. Consider using wp_cache_get() / wp_cache_set() or wp_cache_delete().

WARNINGSecurityNonce verification recommendedProcessing form data without nonce verification.48
Category
Security
Occurrences
48
Severity
warning

Sample message

Processing form data without nonce verification.

WARNINGSecurityInput is not sanitizedDetected usage of a non-sanitized input variable: $_COOKIE['slimstat_tracking_code']45
Category
Security
Occurrences
45
Severity
warning

Sample message

Detected usage of a non-sanitized input variable: $_COOKIE['slimstat_tracking_code']

ERRORSecurityDatabase parameter is not escapedUnescaped parameter $GLOBALS['wpdb']->prefix used in $wpdb->get_results()\n$GLOBALS['wpdb']->prefix used without escaping.44
Category
Security
Occurrences
44
Severity
error

Sample message

Unescaped parameter $GLOBALS['wpdb']->prefix used in $wpdb->get_results()\n$GLOBALS['wpdb']->prefix used without escaping.

Show 15 more
WARNINGSecurityInterpolated SQL is not prepared44
Category
Security
Occurrences
44
Severity
warning

Sample message

Use placeholders and $wpdb->prepare(); found interpolated variable $from at "SELECT COUNT(*) FROM $from WHERE $where_combined"

ERRORI18nMissing Translators Comment44
Category
I18n
Occurrences
44
Severity
error

Sample message

A function call to __() with texts containing placeholders was found, but was not accompanied by a "translators:" comment on the line above to clarify the meaning of the placeholders.

ERRORMaintainabilityMissing direct file access protection37
Category
Maintainability
Occurrences
37
Severity
error

Sample message

PHP file should prevent direct access. Add a check like: if ( ! defined( 'ABSPATH' ) ) exit;

ERRORMaintainabilitydate date32
Category
Maintainability
Occurrences
32
Severity
error

Sample message

date() is affected by runtime timezone changes which can cause date/time to be incorrectly displayed. Use gmdate() instead.

ERRORMaintainabilitywp function not compatible with requires wp32
Category
Maintainability
Occurrences
32
Severity
error

Sample message

Function "str_contains()" requires WordPress 5.9.0, but your plugin minimum supported version is WordPress 5.6.0.

ERRORMaintainabilityparse url parse url27
Category
Maintainability
Occurrences
27
Severity
error

Sample message

parse_url() is discouraged because of inconsistency in the output across PHP versions; use wp_parse_url() instead.

WARNINGSecurityMissing nonce verification26
Category
Security
Occurrences
26
Severity
warning

Sample message

Processing form data without nonce verification.

WARNINGMaintainabilitySchema Change22
Category
Maintainability
Occurrences
22
Severity
warning

Sample message

Attempting a database schema change is discouraged.

WARNINGSecurityDatabase parameter is not escaped21
Category
Security
Occurrences
21
Severity
warning

Sample message

Unescaped parameter $events_table used in $wpdb->get_var()\n$events_table assigned unsafely at line 109.

ERRORMaintainabilityunlink unlink19
Category
Maintainability
Occurrences
19
Severity
error

Sample message

unlink() is discouraged. Use wp_delete_file() to delete a file.

WARNINGSecurityInput is not validated17
Category
Security
Occurrences
17
Severity
warning

Sample message

Detected usage of a possibly undefined superglobal array index: $_POST['filter_array']. Check that the array index exists before using it.

ERRORSecurityUnsafe printing function16
Category
Security
Occurrences
16
Severity
error

Sample message

All output should be run through an escaping function (like esc_html_e() or esc_attr_e()), found '_e'.

WARNINGMaintainabilityNon-prefixed function13
Category
Maintainability
Occurrences
13
Severity
warning

Sample message

Functions declared in the global namespace by a theme/plugin should start with the theme/plugin prefix. Found: "getallheaders".

WARNINGMaintainabilityerror log trigger error13
Category
Maintainability
Occurrences
13
Severity
warning

Sample message

trigger_error() found. Debug code should not normally be used in production.

WARNINGMaintainabilityerror log var export13
Category
Maintainability
Occurrences
13
Severity
warning

Sample message

var_export() found. Debug code should not normally be used in production.

External Connections

Potential connections found in static code analysis.

70 domains

Outbound calls

274

External assets

0

Incoming endpoints

24

Notable Domains

github.com38 · outbound
php.net37 · outbound
datatracker.ietf.org26 · outbound
wp-slimstat.com18 · outbound
tools.ietf.org16 · outbound
en.wikipedia.org10 · outbound

Platform / Reference Domains

w3.org22 · platform/reference
wordpress.org6 · platform/reference
codex.wordpress.org1 · platform/reference
gnu.org1 · platform/reference

External Asset Domains

No external asset domains detected.

Incoming Endpoints

/wp-json/slimstat/v1/consent-changeREST

register_rest_route

/wp-json/slimstat/v1/consent-healthREST

register_rest_route

/wp-json/slimstat/v1/gdpr/consentREST

register_rest_route

/wp-json/slimstat/v1/getREST

register_rest_route

/wp-json/slimstat/v1/hitREST

register_rest_route

/wp-json/slimstat/v1/tracker-healthREST

register_rest_route

Admin AJAX endpoints13
wp_ajax_slimstat_authenticated

wp_ajax

admin_post_slimstat_reset_layoutauthenticated

admin_post

wp_ajax_my_report_dataauthenticated

wp_ajax

wp_ajax_slimstat_clear_cacheauthenticated

wp_ajax

wp_ajax_slimstat_consent_revokedauthenticated

wp_ajax

wp_ajax_slimstat_fetch_chart_dataauthenticated

wp_ajax

wp_ajax_slimstat_gdpr_consentauthenticated

wp_ajax

wp_ajax_slimstat_get_live_analytics_dataauthenticated

wp_ajax

wp_ajax_slimstat_load_reportauthenticated

wp_ajax

wp_ajax_slimstat_migration_dismissauthenticated

wp_ajax

wp_ajax_slimstat_migration_resetauthenticated

wp_ajax

wp_ajax_slimstat_run_migrationsauthenticated

wp_ajax

1 more hidden

Score History

2 score snapshots

+1
1007550250Jun 20, 2026, 01:08 AM UTC Score 24/100 Plugin v5.4.12 Plugin Check 2.0.0 1,169 errors, 737 warningsJun 24, 2026, 09:57 AM UTC Score 25/100 Plugin v5.5.0 Plugin Check 2.0.0 1,177 errors, 870 warningsJun 20, 2026Jun 24, 2026

v5.5.0

25

Latest

Findings
2,047
Errors
1,177
Warnings
870
Check
2.0.0

v5.4.12

24

Score

Findings
1,906
Errors
1,169
Warnings
737
Check
2.0.0

Relationship Map

Author, categories, issues, domains, and nearby plugins.

37 nodes

Related Plugins

Machete

7k+ active installs

99
Search Analytics for WP

3k+ active installs

99
Web Worker Offloading

10k+ active installs

99
Google Tag Manager

10k+ active installs

98