Optimize, compress and resize images in WordPress in bulk. Lazy load images. Auto resize and optimize images upon upload.
Category Scores
Top Issues by Category
maintainability106
i18n28
security27
Issues Details
165 issues found in latest scan
PHP file should prevent direct access. Add a check like: if ( ! defined( 'ABSPATH' ) ) exit;
Mismatched text domain. Expected 'wpvivid-imgoptim' but got 'WpAdminStyle'.
$_POST['cdn'] not unslashed before sanitization. Use wp_unslash() or similar
File operations should use WP_Filesystem methods instead of direct PHP filesystem calls. Found: fopen().
error_log() found. Debug code should not normally be used in production.
File operations should use WP_Filesystem methods instead of direct PHP filesystem calls. Found: fclose().
File operations should use WP_Filesystem methods instead of direct PHP filesystem calls. Found: fread().
Processing form data without nonce verification.
File operations should use WP_Filesystem methods instead of direct PHP filesystem calls. Found: fwrite().
File operations should use WP_Filesystem methods instead of direct PHP filesystem calls. Found: mkdir().
Functions declared in the global namespace by a theme/plugin should start with the theme/plugin prefix. Found: "phpseclib_resolve_include_path".
Detected usage of a non-sanitized input variable: $_REQUEST['_wp_http_referer']
rename() is discouraged. Use WP_Filesystem::move() to rename a file.
The plugin name includes a restricted term. Your chosen plugin name - "Compress, Resize & Lazy Load Images - WPvivid Image Optimization" - contains the restricted term "wp" which cannot be used at all in your plugin name.
Plugin folders are deleted when upgraded. Do not save data to the plugin folder using fwrite(). Detected usage of constant WP_CONTENT_DIR. Use wp_upload_dir() to get the uploads directory path or save to the database instead.
phpinfo() can lead to full path disclosure.
Processing form data without nonce verification.
File operations should use WP_Filesystem methods instead of direct PHP filesystem calls. Found: rmdir().
mt_rand() is discouraged. Use the far less predictable wp_rand() instead.
strip_tags() is discouraged. Use the more comprehensive wp_strip_all_tags() instead.
Direct database call without caching detected. Consider using wp_cache_get() / wp_cache_set() or wp_cache_delete().
| Code | Type | Message | Count |
|---|---|---|---|
| missing_direct_file_access_protection | ERROR | PHP file should prevent direct access. Add a check like: if ( ! defined( 'ABSPATH' ) ) exit; | 28 |
| WordPress.WP.I18n.TextDomainMismatch | ERROR | Mismatched text domain. Expected 'wpvivid-imgoptim' but got 'WpAdminStyle'. | 20 |
| WordPress.Security.ValidatedSanitizedInput.MissingUnslash | WARNING | $_POST['cdn'] not unslashed before sanitization. Use wp_unslash() or similar | 17 |
| WordPress.WP.AlternativeFunctions.file_system_operations_fopen | ERROR | File operations should use WP_Filesystem methods instead of direct PHP filesystem calls. Found: fopen(). | 14 |
| Squiz.PHP.DiscouragedFunctions.Discouraged | WARNING | The use of function ini_set() is discouraged | 10 |
| WordPress.PHP.DevelopmentFunctions.error_log_error_log | WARNING | error_log() found. Debug code should not normally be used in production. | 8 |
| WordPress.WP.AlternativeFunctions.file_system_operations_fclose | ERROR | File operations should use WP_Filesystem methods instead of direct PHP filesystem calls. Found: fclose(). | 8 |
| WordPress.WP.I18n.MissingArgDomain | ERROR | Missing $domain parameter in function call to __(). | 8 |
| WordPress.WP.AlternativeFunctions.file_system_operations_fread | ERROR | File operations should use WP_Filesystem methods instead of direct PHP filesystem calls. Found: fread(). | 6 |
| WordPress.Security.NonceVerification.Recommended | WARNING | Processing form data without nonce verification. | 5 |
| WordPress.WP.AlternativeFunctions.file_system_operations_fwrite | ERROR | File operations should use WP_Filesystem methods instead of direct PHP filesystem calls. Found: fwrite(). | 5 |
| WordPress.WP.AlternativeFunctions.file_system_operations_mkdir | ERROR | File operations should use WP_Filesystem methods instead of direct PHP filesystem calls. Found: mkdir(). | 4 |
| WordPress.NamingConventions.PrefixAllGlobals.NonPrefixedFunctionFound | WARNING | Functions declared in the global namespace by a theme/plugin should start with the theme/plugin prefix. Found: "phpseclib_resolve_include_path". | 3 |
| WordPress.Security.ValidatedSanitizedInput.InputNotSanitized | WARNING | Detected usage of a non-sanitized input variable: $_REQUEST['_wp_http_referer'] | 3 |
| WordPress.WP.AlternativeFunctions.rename_rename | ERROR | rename() is discouraged. Use WP_Filesystem::move() to rename a file. | 3 |
| trademarked_term | WARNING | The plugin name includes a restricted term. Your chosen plugin name - "Compress, Resize & Lazy Load Images - WPvivid Image Optimization" - contains the restricted term "wp" which cannot be used at all in your plugin name. | 3 |
| Generic.PHP.ForbiddenFunctions.Found | ERROR | The use of function create_function() is forbidden | 2 |
| PluginCheck.CodeAnalysis.WriteFile.PluginDirectoryWrite | ERROR | Plugin folders are deleted when upgraded. Do not save data to the plugin folder using fwrite(). Detected usage of constant WP_CONTENT_DIR. Use wp_upload_dir() to get the uploads directory path or save to the database instead. | 2 |
| WordPress.PHP.DevelopmentFunctions.prevent_path_disclosure_phpinfo | WARNING | phpinfo() can lead to full path disclosure. | 2 |
| WordPress.Security.NonceVerification.Missing | WARNING | Processing form data without nonce verification. | 2 |
| WordPress.WP.AlternativeFunctions.file_system_operations_rmdir | ERROR | File operations should use WP_Filesystem methods instead of direct PHP filesystem calls. Found: rmdir(). | 2 |
| WordPress.WP.AlternativeFunctions.rand_mt_rand | ERROR | mt_rand() is discouraged. Use the far less predictable wp_rand() instead. | 2 |
| WordPress.WP.AlternativeFunctions.strip_tags_strip_tags | ERROR | strip_tags() is discouraged. Use the more comprehensive wp_strip_all_tags() instead. | 2 |
| WordPress.DB.DirectDatabaseQuery.DirectQuery | WARNING | Use of a direct database call is discouraged. | 1 |
| WordPress.DB.DirectDatabaseQuery.NoCaching | WARNING | Direct database call without caching detected. Consider using wp_cache_get() / wp_cache_set() or wp_cache_delete(). | 1 |
Latest Snapshot
Findings
165
Errors
107
Warnings
58
Score History
First score snapshot
First scan completed Jun 20, 2026
v0.9.25 · Plugin Check 2.0.0 · Model 2026.06-mvp-static-v2
Jun 20, 2026
v0.9.25
47
Latest
- Findings
- 165
- Errors
- 107
- Warnings
- 58
- Plugin Check
- 2.0.0
- Model
- 2026.06-mvp-static-v2
| Scan | Score | Findings | Errors | Warnings | Plugin | Plugin Check | Model |
|---|---|---|---|---|---|---|---|
| Jun 20, 2026Latest | 47 | 165 | 107 | 58 | v0.9.25 | 2.0.0 | 2026.06-mvp-static-v2 |