Add custom tabs with content to products in WooCommerce.
Category Scores
Top Issues by Category
security109
maintainability48
i18n7
Issues Details
168 issues found in latest scan
All output should be run through an escaping function (see the Security sections in the WordPress Developer Handbooks), found '$field['class']'.
All output should be run through an escaping function (like esc_html_e() or esc_attr_e()), found '_e'.
$_GET['saved-tab-id'] not unslashed before sanitization. Use wp_unslash() or similar
Global variables defined by a theme/plugin should start with the theme/plugin prefix. Found: "$edit_tab_url".
PHP file should prevent direct access. Add a check like: if ( ! defined( 'ABSPATH' ) ) exit;
Detected usage of a non-sanitized input variable: $_POST['_yikes_wc_custom_repeatable_product_tabs_saved_tab_id_' . $i . '_action']
Processing form data without nonce verification.
In footer ($in_footer) is not set explicitly wp_enqueue_script; It is recommended to load scripts in the footer. Please set this value to `true` to load it in the footer, or explicitly `false` if it should be loaded in the header.
Processing form data without nonce verification.
Function "register_rest_route()" requires WordPress 4.4.0, but your plugin minimum supported version is WordPress 3.8.0.
A function call to __() with texts containing placeholders was found, but was not accompanied by a "translators:" comment on the line above to clarify the meaning of the placeholders.
Direct database call without caching detected. Consider using wp_cache_get() / wp_cache_set() or wp_cache_delete().
Detected usage of a possibly undefined superglobal array index: $_POST['number_of_tabs']. Check that the array index exists before using it.
Resource version not set in call to wp_enqueue_style(). This means new versions of the style may not always be loaded due to browser caching.
The $domain parameter must be a single text string literal. Found: YIKES_Custom_Product_Tabs_Settings_Page
Multiple placeholders in translatable strings should be ordered. Expected "%1$1s, %2$2s", but got "%1s, %2s" in 'It looks like something went wrong. Please %1sgo back%2s. and try again'.
Detected usage of meta_key, possible slow query.
Hook names invoked by a theme/plugin should start with the theme/plugin prefix. Found: "the_content".
Your plugin has a different license declared in the readme file and plugin header. Please update your readme with a valid GPL license identifier.
Tested up to: 6.7 < 7.0. The "Tested up to" value in your plugin is not set to the current version of WordPress. This means your plugin will not show up in searches, as we require plugins to be compatible and documented as tested up to the most recent version of WordPress.
The "Domain Path" header in the plugin file must start with forward slash.
One or more tags were ignored. Please limit your plugin to 5 tags.
The plugin slug includes a restricted term. Your plugin slug - "yikes-inc-easy-custom-woocommerce-product-tabs" - contains the restricted term "woocommerce" which cannot be used within in your plugin slug, unless your plugin slug contains one of the allowed patterns: "for woocommerce", "with woocommerce", "using woocommerce", or "and woocommerce". The term must still not appear anywhere else in your plugin slug.
| Code | Type | Message | Count |
|---|---|---|---|
| WordPress.Security.EscapeOutput.OutputNotEscaped | ERROR | All output should be run through an escaping function (see the Security sections in the WordPress Developer Handbooks), found '$field['class']'. | 38 |
| WordPress.Security.EscapeOutput.UnsafePrintingFunction | ERROR | All output should be run through an escaping function (like esc_html_e() or esc_attr_e()), found '_e'. | 23 |
| WordPress.Security.ValidatedSanitizedInput.MissingUnslash | WARNING | $_GET['saved-tab-id'] not unslashed before sanitization. Use wp_unslash() or similar | 17 |
| WordPress.NamingConventions.PrefixAllGlobals.NonPrefixedVariableFound | WARNING | Global variables defined by a theme/plugin should start with the theme/plugin prefix. Found: "$edit_tab_url". | 14 |
| missing_direct_file_access_protection | ERROR | PHP file should prevent direct access. Add a check like: if ( ! defined( 'ABSPATH' ) ) exit; | 13 |
| WordPress.Security.ValidatedSanitizedInput.InputNotSanitized | WARNING | Detected usage of a non-sanitized input variable: $_POST['_yikes_wc_custom_repeatable_product_tabs_saved_tab_id_' . $i . '_action'] | 12 |
| WordPress.Security.NonceVerification.Missing | WARNING | Processing form data without nonce verification. | 11 |
| WordPress.WP.EnqueuedResourceParameters.NotInFooter | WARNING | In footer ($in_footer) is not set explicitly wp_enqueue_script; It is recommended to load scripts in the footer. Please set this value to `true` to load it in the footer, or explicitly `false` if it should be loaded in the header. | 8 |
| WordPress.Security.NonceVerification.Recommended | WARNING | Processing form data without nonce verification. | 6 |
| wp_function_not_compatible_with_requires_wp | ERROR | Function "register_rest_route()" requires WordPress 4.4.0, but your plugin minimum supported version is WordPress 3.8.0. | 4 |
| WordPress.WP.I18n.MissingTranslatorsComment | ERROR | A function call to __() with texts containing placeholders was found, but was not accompanied by a "translators:" comment on the line above to clarify the meaning of the placeholders. | 3 |
| WordPress.DB.DirectDatabaseQuery.DirectQuery | WARNING | Use of a direct database call is discouraged. | 2 |
| WordPress.DB.DirectDatabaseQuery.NoCaching | WARNING | Direct database call without caching detected. Consider using wp_cache_get() / wp_cache_set() or wp_cache_delete(). | 2 |
| WordPress.Security.ValidatedSanitizedInput.InputNotValidated | WARNING | Detected usage of a possibly undefined superglobal array index: $_POST['number_of_tabs']. Check that the array index exists before using it. | 2 |
| WordPress.WP.EnqueuedResourceParameters.MissingVersion | WARNING | Resource version not set in call to wp_enqueue_style(). This means new versions of the style may not always be loaded due to browser caching. | 2 |
| WordPress.WP.I18n.NonSingularStringLiteralDomain | ERROR | The $domain parameter must be a single text string literal. Found: YIKES_Custom_Product_Tabs_Settings_Page | 2 |
| WordPress.WP.I18n.UnorderedPlaceholdersText | ERROR | Multiple placeholders in translatable strings should be ordered. Expected "%1$1s, %2$2s", but got "%1s, %2s" in 'It looks like something went wrong. Please %1sgo back%2s. and try again'. | 2 |
| WordPress.DB.SlowDBQuery.slow_db_query_meta_key | WARNING | Detected usage of meta_key, possible slow query. | 1 |
| WordPress.NamingConventions.PrefixAllGlobals.NonPrefixedHooknameFound | WARNING | Hook names invoked by a theme/plugin should start with the theme/plugin prefix. Found: "the_content". | 1 |
| license_mismatch | ERROR | Your plugin has a different license declared in the readme file and plugin header. Please update your readme with a valid GPL license identifier. | 1 |
| outdated_tested_upto_header | ERROR | Tested up to: 6.7 < 7.0. The "Tested up to" value in your plugin is not set to the current version of WordPress. This means your plugin will not show up in searches, as we require plugins to be compatible and documented as tested up to the most recent version of WordPress. | 1 |
| plugin_header_invalid_domain_path | WARNING | The "Domain Path" header in the plugin file must start with forward slash. | 1 |
| readme_parser_warnings_too_many_tags | WARNING | One or more tags were ignored. Please limit your plugin to 5 tags. | 1 |
| trademarked_term | WARNING | The plugin slug includes a restricted term. Your plugin slug - "yikes-inc-easy-custom-woocommerce-product-tabs" - contains the restricted term "woocommerce" which cannot be used within in your plugin slug, unless your plugin slug contains one of the allowed patterns: "for woocommerce", "with woocommerce", "using woocommerce", or "and woocommerce". The term must still not appear anywhere else in your plugin slug. | 1 |
Latest Snapshot
Findings
168
Errors
87
Warnings
81
Score History
First score snapshot
First scan completed
v1.8.6 · Plugin Check 2.0.0 · Model 2026.06-mvp-static-v2
v1.8.6
36
Latest
- Findings
- 168
- Errors
- 87
- Warnings
- 81
- Plugin Check
- 2.0.0
- Model
- 2026.06-mvp-static-v2
| Scan | Score | Findings | Errors | Warnings | Plugin | Plugin Check | Model |
|---|---|---|---|---|---|---|---|
| Latest | 36 | 168 | 87 | 81 | v1.8.6 | 2.0.0 | 2026.06-mvp-static-v2 |