wordpress-plugin-core

Last Updated : 2026-01-21 Latest Versions : WordPress 6.9+ (Dec 2, 2025), PHP 8.0+ recommended, PHP 8.5 compatible Dependencies : None (WordPress 5.9+, PHP 7.4+ minimum) Architecture Patterns : Simple (functions only, prepare() for all database queries with user input ✅ Sanitize input with sanitize_*() functions before saving ✅ Escape output with esc_*() functions before displaying ✅ Flush rewrite rules on activation when registering custom post types ✅ Use uninstall.php for permanent cleanup (not deactivation hook) ✅ Follow WordPress Coding Standards (tabs for indentation, Yoda conditions) ❌ Never use extract() - Creates security vulnerabilities ❌ Never trust $_POST/$_GET without sanitization ❌ Never concatenate user input into SQL - Always use prepare() ❌ Never use is_admin() alone for permission checks ❌ Never output unsanitized data - Always escape ❌ Never use generic function/class names - Always prefix ❌ Never use short PHP tags prepare() with placeholders Error : Malicious JavaScript executed in user browsers Source : (35% of all vulnerabilities) Why It Happens : Outputting unsanitized user data to HTML Prevention : Always escape output with context-appropriate function Error : Unauthorized actions performed on behalf of users Source : Why It Happens : No verification that requests originated from your site Prevention : Use nonces with wp_nonce_field() and...