Skip to content
WordPress Coding Standards

Security: Fix critical XSS, weak encryption, and input sanitization vulnerabilities #18

Sign in to view logs

Security: Fix critical XSS, weak encryption, and input sanitization vulnerabilities

Security: Fix critical XSS, weak encryption, and input sanitization vulnerabilities #18

Re-run triggered December 6, 2025 20:21
@katsar0vkatsar0v
#61
copilot/security-audit-wordpress-plugin
Status Failure
Total duration 26s
Artifacts –

phpcs.yml

on: pull_request
PHPCS Check
21s
PHPCS Check
Fit to window
Zoom out
Zoom in

Annotations

10 errors and 10 warnings
PHPCS Check: admin/partials/settings.php#L73
All output should be run through an escaping function (like esc_html_e() or esc_attr_e()), found '_e'.
PHPCS Check: admin/partials/settings.php#L68
All output should be run through an escaping function (like esc_html_e() or esc_attr_e()), found '_e'.
PHPCS Check: admin/partials/settings.php#L63
All output should be run through an escaping function (like esc_html_e() or esc_attr_e()), found '_e'.
PHPCS Check: admin/partials/settings.php#L58
All output should be run through an escaping function (like esc_html_e() or esc_attr_e()), found '_e'.
PHPCS Check: admin/partials/settings.php#L53
All output should be run through an escaping function (like esc_html_e() or esc_attr_e()), found '_e'.
PHPCS Check: admin/partials/settings.php#L48
All output should be run through an escaping function (like esc_html_e() or esc_attr_e()), found '_e'.
PHPCS Check: admin/partials/settings.php#L40
All output should be run through an escaping function (like esc_html_e() or esc_attr_e()), found '_e'.
PHPCS Check: admin/partials/compose.php#L189
A function call to esc_html__() with texts containing placeholders was found, but was not accompanied by a "translators:" comment on the line above to clarify the meaning of the placeholders.
PHPCS Check: admin/partials/compose.php#L113
A function call to __() with texts containing placeholders was found, but was not accompanied by a "translators:" comment on the line above to clarify the meaning of the placeholders.
PHPCS Check: admin/partials/lists.php#L170
All output should be run through an escaping function (see the Security sections in the WordPress Developer Handbooks), found '$subscriber_count'.
PHPCS Check: admin/partials/dashboard.php#L32
Direct database call without caching detected. Consider using wp_cache_get() / wp_cache_set() or wp_cache_delete().
PHPCS Check: admin/partials/dashboard.php#L32
Use of a direct database call is discouraged.
PHPCS Check: admin/partials/dashboard.php#L29
Direct database call without caching detected. Consider using wp_cache_get() / wp_cache_set() or wp_cache_delete().
PHPCS Check: admin/partials/dashboard.php#L29
Use of a direct database call is discouraged.
PHPCS Check: admin/partials/dashboard.php#L15
Direct database call without caching detected. Consider using wp_cache_get() / wp_cache_set() or wp_cache_delete().
PHPCS Check: admin/partials/dashboard.php#L15
Use of a direct database call is discouraged.
PHPCS Check: admin/partials/settings.php#L32
base64_decode() can be used to obfuscate code which is strongly discouraged. Please verify that the function is used for benign reasons.
PHPCS Check: admin/partials/compose.php#L26
Processing form data without nonce verification.
PHPCS Check: admin/partials/lists.php#L30
Direct database call without caching detected. Consider using wp_cache_get() / wp_cache_set() or wp_cache_delete().
PHPCS Check: admin/partials/lists.php#L30
Use of a direct database call is discouraged.