ERROR

[ie1963]

Hello.
I found errors in your plugin.
Plugin Check finds them.
Let's say:
<Missing $domain parameter in function call to __()> I don't consider it an error.
But this <All output should be run through an escaping function (see the Security sections in the WordPress Developer Handbooks), found '$item_id'> is an error.
I'm writing a WordPress plugin and try to follow best practices. I thought Gutenberg 22.1.1 was definitely error-free, updated on November 21, 2025, so what?
Tons of errors. The same goes for other recommended plugins.
Question: Which plugin should I consider as a model for compliance with the WordPress coding code?
Conclusion: There are no such plugins, but there is a verification team that relies on WPCS and PHPCS and requires compliance with standards that no one else follows.
What's the logic?
Thank you for reading.
Best regards.

[westonruter]

Translation functions are not typically escaped in core because they are trusted and reviewed. See https://core.trac.wordpress.org/ticket/56110#comment:2

[ie1963]

Thank you.
Short and clear.
Let me reiterate what to do with

<Global variables defined by a theme/plugin should start with the theme/plugin prefix>

Do I really need to add a prefix to all variables?
Best regards

[westonruter]

I see that this is a question about coding standards for plugins and not core, so I'm going to close this as invalid.

This is a better question for the support forum: ​https://wordpress.org/support/forum/requests-and-feedback/

[sabernhardt]

One resource to check is
​https://developer.wordpress.org/plugins/plugin-basics/best-practices/#avoid-naming-collisions

I should mention that Gutenberg is not a good example for third-party plugin developers because its code is written to be included within WordPress Core.