The "/vendor" directory using composer exists, but "composer.json" file is missing.

print_r() found. Debug code should not normally be used in production.

error_log() found. Debug code should not normally be used in production.

Dynamic argument passed in third parameter of register_setting(). Please ensure proper sanitization.

trigger_error() found. Debug code should not normally be used in production.

Processing form data without nonce verification.

Processing form data without nonce verification.

Using exclusionary parameters, like post__not_in, in calls to get_posts() should be done with caution, see https://wpvip.com/documentation/performance-improvements-by-removing-usage-of-post__not_in/ for more information.

Images should be added using wp_get_attachment_image() or similar functions