Products
In-IDE
IDE extension that lets you fix coding issues before they exist!
Discover SonarQube for IDE
SaaS
Setup is effortless and analysis is automatic for most languages
Discover SonarQube Cloud
Self-Hosted
Fast, accurate analysis; enterprise scalability
Discover SonarQube Server

Secrets
ABAP
Ansible
Apex
AzureResourceManager
C
C#
C++
CloudFormation
COBOL
CSS
Dart
Docker
Flex
GitHub Actions
Go
HTML
Java
JavaScript
JSON
JCL
Kotlin
Kubernetes
Objective C
PHP
PL/I
PL/SQL
Python
RPG
Ruby
Rust
Scala
Shell
Swift
Terraform
Text
TypeScript
T-SQL
VB.NET
VB6
XML
YAML

PHP static code analysis

Unique rules to find Bugs, Vulnerabilities, Security Hotspots, and Code Smells in your PHP code

Tags

Impact

Clean code attribute

Server-side requests should not be vulnerable to traversing attacks
Vulnerability
Credentials should not be hard-coded
Vulnerability
Secrets should not be hard-coded
Vulnerability
Prevent unfiltered HTML exposure in WordPress for enhanced security
Vulnerability
Prevent unauthenticated WordPress database repair for enhanced security
Vulnerability
External requests should be restricted in WordPress to prevent data leaks and SSRF
Vulnerability
Automatic updates should not be disabled
Vulnerability
Disable direct file editing in WordPress admin interface
Vulnerability
Secret keys and salt values should be robust
Vulnerability
Applications should not create session cookies from untrusted input
Vulnerability
Reflection should not be vulnerable to injection attacks
Vulnerability
OS commands should not be vulnerable to argument injection attacks
Vulnerability
A new session should be created during user authentication
Vulnerability
Authorizations should be based on strong decisions
Vulnerability
Cipher algorithms should be robust
Vulnerability
Encryption algorithms should be used with secure mode and padding scheme
Vulnerability
Server hostnames should be verified during SSL/TLS connections
Vulnerability
Include expressions should not be vulnerable to injection attacks
Vulnerability
Dynamic code execution should not be vulnerable to injection attacks
Vulnerability
Session IDs must be securely generated and not user-specified
Vulnerability
HTTP request redirections should not be open to forging attacks
Vulnerability
Logging should not be vulnerable to injection attacks
Vulnerability
Server-side requests should not be vulnerable to forging attacks
Vulnerability
Deserialization should not be vulnerable to injection attacks
Vulnerability
Endpoints should not be vulnerable to reflected cross-site scripting (XSS) attacks
Vulnerability
Avoid overly permissive Cross-Origin Resource Sharing (CORS) policies to enhance security
Vulnerability
Server certificates should be verified during SSL/TLS connections
Vulnerability
Deactivate debugging features before deploying to production
Vulnerability
LDAP connections should be authenticated
Vulnerability
Cryptographic keys should be robust
Vulnerability
Weak SSL/TLS protocols should not be used
Vulnerability
Database queries should not be vulnerable to injection attacks
Vulnerability
"file_uploads" should be disabled
Vulnerability
"enable_dl" should be disabled
Vulnerability
"session.use_trans_sid" should not be enabled
Vulnerability
"cgi.force_redirect" should be enabled
Vulnerability
"allow_url_fopen" and "allow_url_include" should be disabled
Vulnerability
"open_basedir" should limit file access
Vulnerability
Session-management cookies should not be persistent
Vulnerability
"sleep" should not be called
Vulnerability
XML parsers should not be vulnerable to XXE attacks
Vulnerability
Regular expressions should not be vulnerable to Denial of Service attacks
Vulnerability
Avoid overly permissive POSIX file permissions to enhance security
Vulnerability
Neither DES (Data Encryption Standard) nor DESede (3DES) should be used
Vulnerability
Cryptographic RSA algorithms should always incorporate OAEP (Optimal Asymmetric Encryption Padding)
Vulnerability
A secure password should be used when connecting to a database
Vulnerability
XPath expressions should not be vulnerable to injection attacks
Vulnerability
I/O function calls should not be vulnerable to path injection attacks
Vulnerability
LDAP queries should not be vulnerable to injection attacks
Vulnerability
Use prepared statements to securely construct SQL queries
Vulnerability
OS commands should not be vulnerable to command injection attacks
Vulnerability
SHA-1 and Message-Digest hash algorithms should not be used in secure contexts
Vulnerability
Credentials should not be hard-coded
Vulnerability
Password hashing functions should use an unpredictable salt
Vulnerability

Prevent unfiltered HTML exposure in WordPress for enhanced security

intentionality - complete

security

Vulnerability

Why is this an issue?

How can I fix it?

More Info

By default, the WordPress administrator and editor roles can add unfiltered HTML content in various places, such as post content. This includes the capability to add JavaScript code.

If an account with such a role gets hijacked, this capability can be used to plant malicious JavaScript code that gets executed whenever somebody visits the website.

This may lead to Cross-Site Scripting (XSS) attacks, which can be used to steal other users' credentials or perform actions on behalf of other users.

Available In:

Catch issues on the fly,
in your IDE

Detect issues in your GitHub, Azure DevOps Services, Bitbucket Cloud, GitLab repositories

Analyze code in your
on-premise CI

Available Since
9.1

Analyze code in your
on-premise CI

Developer Edition
Available Since
9.1

In-IDE

SaaS

Self-Hosted