Emailed Author: There are issues with your plugin code. Please read this ENTIRE email, address all listed issues, and reply to this email with your corrected code attached. It is required for you to read and reply to these emails, and failure to do so will result in significant delays with your plugin being accepted.
## Not using Nonces and/or checking permissions
Please add a nonce to your POST calls to prevent unauthorized access.
Keep in mind, check_admin_referer alone is NOT bulletproof security. Do not rely on nonces for authorization purposes. Use current_user_can() in order to prevent users without the right permissions from accessing things.
https://codex.wordpress.org/WordPress_Nonces
## Including jquery files (or calling them remotely)
Your plugin has included your own copy of a core jQuery file (or called it remotely, probably from Google or jquery.com).
WordPress includes its own version of jquery and many other similar JS files, which have all been rigorously tested with WP and many of the most common plugins. In order to provide the best compatibility and experience for our users, we ask that you not package your own (especially not an older version) and instead use wp_enqueue_script() to pull in WordPress's version.
Please review https://developer.wordpress.org/reference/functions/wp_enqueue_script/ and update your plugin accordingly. You need to both change your code to use our jquery as well as remove the unused files. Remember! Keeping unused files out of your plugins makes them smaller and less potentially vulnerable! if you have any jquery files included in your plugin that WP core has, just delete them.
Offloading jQuery js, css, and other scripts to Google (or jquery.com or anywhere else frankly) is similarly disallowed for the same reasons, but also because you're introducing an unnecessary dependency on another site. If the file you're trying to use isn't a part of WordPress Core, then you should include it -locally- in your plugin, not remotely. Please check first. We have a LOT of JS files :)
If your code doesn't work with the built-in versions of jQuery, it's most likely a no conflict issue.
If you can't guess, we -really- want you to use our JS files, and if you can't, we need to know why so we can fix things for everyone. If you're just including it because you want to support old versions of WP, or because you think they may not have jQuery, please don't. If they don't have the default jQuery, a lot more than your plugin will break. And if they're on older versions of WordPress, they need to upgrade.
We do not recommend you support anything except the most recent version of WP and one release back. After all, we don't.
## Calling images remotely
Offloading images to your own server is disallowed.
Please include all images needed for your plugin locally.
http://www.pirolab.it/pirobox/js/error.jpg should be local.
----
Please make sure you've addressed ALL issues brought up in this email. When you've corrected your code, reply to this email with the updated code attached as a zip, or provide a link to the new code for us to review. If you have questions, concerns, or need clarification, please reply to this email and just ask us.
(While we have tried to make this review as exhaustive as possible we, like you, are humans and may have missed things. As such, we will re-review the ENTIRE plugin when you send it back to us. We appreciate your patience and understanding in this.)