All output should be run through an escaping function (see the Security sections in the WordPress Developer Handbooks), found '$hnbRatesUri'.

All output should be run through an escaping function (see the Security sections in the WordPress Developer Handbooks), found 'wpautop'.

All output should be run through an escaping function (see the Security sections in the WordPress Developer Handbooks), found '$this'.

A function call to __() with texts containing placeholders was found, but was not accompanied by a "translators:" comment on the line above to clarify the meaning of the placeholders.

All output should be run through an escaping function (see the Security sections in the WordPress Developer Handbooks), found '$text'.

json_encode() is discouraged. Use wp_json_encode() instead.

All output should be run through an escaping function (see the Security sections in the WordPress Developer Handbooks), found '$text'.

strip_tags() is discouraged. Use the more comprehensive wp_strip_all_tags() instead.

Hidden files are not permitted.

Use placeholders and $wpdb->prepare(); found $table_name

Use of a direct database call is discouraged.

Direct database call without caching detected. Consider using wp_cache_get() / wp_cache_set() or wp_cache_delete().

Use placeholders and $wpdb->prepare(); found interpolated variable $table_name at "SELECT COUNT(*) FROM $table_name WHERE transaction_id = %s"

Use of a direct database call is discouraged.

Direct database call without caching detected. Consider using wp_cache_get() / wp_cache_set() or wp_cache_delete().

Use of a direct database call is discouraged.

Detected usage of a possibly undefined superglobal array index: $_SERVER['REQUEST_METHOD']. Use isset() or empty() to check the index exists before using it

$_POST['payway_nonce'] not unslashed before sanitization. Use wp_unslash() or similar

Detected usage of a non-sanitized input variable: $_POST['payway_nonce']