0

I have bought a Wordpress theme and scanned its files on www.themecheck.info. The results show 3 critical alerts and 9 warnings:

Alerts:

  1. Presence of iframes : iframes are sometimes used to load unwanted adverts and malicious code on another site Found  in file vc_gmaps.php. 6: 'link' => 'https://www.google.com/maps/d/embed?mid=zy8g7PkInS5s.k1_kczfkJFound  in file content.php. 634: $video_block = '';
    1. Malware : Operations on file system file_get_contents was found in the file functions.php 686: $font_json_file = file_get_contents(get_template_directory() . '/fonts/webfonts.json');
    2. Admin menu : Themes should use add_theme_page() for adding admin pages. File class-tgm-plugin-activation.php : 724: $this->page_hook = add_submenu_page( $args['parent_slug'], $args['page_title'], $args['menu_tiFile options.php : 5913: $page = add_submenu_page('thegem-theme-options',esc_html__('TheGem Theme Options','File image-generator.php : 187: add_submenu_page(null, esc_html__('TheGem thumbnails','thegem'), esc_html__File functions.php : 121: $page = add_menu_page(esc_html__('TheGem','thegem'), esc_html__('TheGem','thegem'),File functions.php : 1876: $page = add_submenu_page('thegem-theme-options', esc_html__('Self-Hosted Fonts','th2135: $page = add_submenu_page(NULL, esc_html__('Add new social network','thegem'), '', 'File functions.php : 1876: $page = add_submenu_page('thegem-theme-options', esc_html__('Self-Hosted Fonts','th2135: $page = add_submenu_page(NULL, esc_html__('Add new social network','thegem'), '', '

Warnings:

  1. Text domain : Incorrect use of translation functions.Found a translation function that is missing a text-domain. Function __, with the arguments 'Save my name, email, and website in this browser for the next time I comment.' in file single-product-reviews.php.Found a translation function that is missing a text-domain. Function __, with the arguments 'Save my name, email, and website in this browser for the next time I comment.' in file comments.php.More than one text-domain is being used in this theme. This means the theme will not be compatible with WordPress.org language packs. The domains found are woocommerce, thegem, yith-woocommerce-wishlist, tgmpa, default, contact-form-7.
    1. PHP short tags : Presence of PHP short tagsPHP short tags were found in file lazy-items.class.php. "This practice is discouraged because they are only available if enabled with short_open_tag php.ini configuration file directive, or if PHP was configured with the --enable-short-tags option" (php.net), which is not the case on many servers.56: visibilityOffset: visibilityOffset)?>,
    2. Line endings consistency : Both DOS and UNIX style line endingsFound a mix of \r\n and \n line endings in file style-editor.css.Found a mix of \r\n and \n line endings in file thegem-itemsAnimations.css.Found a mix of \r\n and \n line endings in file thegem-itemsAnimations.js.Found a mix of \r\n and \n line endings in file jquery.juraSlider.js.
    3. Custom elements : Presence of custom headerNo reference to custom header was found in the theme.
    4. Custom elements : Presence of custom backgroundNo reference to custom background was found in the theme.
    5. I18N implementation : Proper use of _x(Possible variable $v found in translation function in functions.php. Translation function calls should not contain PHP variables.
    6. CSS files : Presence of Author URICould not find Author URI.
    7. Date and time implementation : Use of the_date()At least one hard coded date was found in the file content.php. Function get_option( 'date_format' ) should be used instead.
    8. Screenshot : Screenshot fileBad screenshot file extension ! File screenshot.png is not an actual JPG file. Detected type was : "image/png".

Can anybody comment what are the risks of using this theme? Is it better to choose another one? The developer says that the theme is safe to use, but I am not sure.

  • Is the theme a php page you add on your server? – Vipul Nair Oct 18 '19 at 17:39
  • Most likely, if I understand your question correctly. It consists of many php files and would be installed to the Wordpress site. – elievi Oct 20 '19 at 17:40

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.