WordPress.Security.EscapeOutput.ExceptionNotEscaped
Exception output is not escaped
An exception message or related exception value is printed without escaping.
Why It Shows Up
The scan found exception data being displayed directly in HTML output.
Why It Matters
Exception messages can include file paths, request values, remote API responses, or database details. Printing them raw can expose information or create XSS risk.
How to Fix
- Use `esc_html()` or another context-appropriate escaping function before displaying exception text.
- Show a generic user-facing message and log the detailed exception for administrators or developers.
- Do not print stack traces, paths, or raw remote responses on public pages.
References
Affected Plugins
| Rank | Plugin | Score | Errors | Warnings | Installs | Added | Updated | Top Issue |
|---|---|---|---|---|---|---|---|---|
| #1 | Intercom | 0 | 60 | 71 | 6k+ | Non-prefixed function | ||
| #2 | Live Shopping & Shoppable Videos For WooCommerce | 0 | 79 | 174 | 400 | Non-prefixed global variable | ||
| #3 | Plugin Check (PCP) | 0 | 128 | 140 | 10k+ | Non-prefixed global variable | ||
| #4 | Themify Builder | 9 | 5,389 | 2,245 | 5k+ | Text Domain Mismatch | ||
| #5 | JetBackup – Backup, Restore & Migrate | 10 | 1,567 | 156 | 200k+ | Exception output is not escaped | ||
| #6 | 404 Solution | 15 | 582 | 1,532 | 10k+ | Non-prefixed class | ||
| #7 | Easy WP SMTP – WordPress SMTP and Email Logs: Gmail SMTP, Office 365, Outlook, Custom SMTP, and more | 15 | 45 | 166 | 500k+ | Database parameter is not escaped | ||
| #8 | AnyComment | 17 | 445 | 449 | 5k+ | Output is not escaped | ||
| #9 | RestroPress – Online Food Ordering System | 17 | 536 | 3,236 | 1k+ | Non-prefixed global variable | ||
| #10 | Efí Bank | 17 | 886 | 553 | 300 | Exception output is not escaped | ||
| #11 | Shopping Cart & eCommerce Store | 17 | 7,453 | 17,866 | 3k+ | Non-prefixed global variable | ||
| #12 | Advanced File Manager – Ultimate File Manager for WordPress And Document Library Solution | 18 | 1,229 | 923 | 100k+ | Exception output is not escaped | ||
| #13 | Block Slider – Responsive Image Slider, Video Slider & Post Slider | 19 | 555 | 1,291 | 3k+ | Non-prefixed global variable | ||
| #14 | GiveWP – Donation Plugin and Fundraising Platform | 19 | 3,422 | 3,570 | 100k+ | Output is not escaped | ||
| #15 | Go Fetch Jobs (for WP Job Manager) | 19 | 1,410 | 1,741 | 600 | Non-prefixed global variable | ||
| #16 | Matomo Analytics – Powerful, Privacy-First Insights for WordPress | 19 | 1,993 | 892 | 100k+ | Exception output is not escaped | ||
| #17 | Netgsm | 19 | 352 | 348 | 1k+ | Non-prefixed global variable | ||
| #18 | Really Simple Security – Simple and Performant Security (formerly Really Simple SSL) | 19 | 530 | 375 | 3m+ | Missing Translators Comment | ||
| #19 | Scrollsequence – Cinematic Scroll Image Animation Plugin | 19 | 878 | 1,528 | 3k+ | Non-prefixed global variable | ||
| #20 | SendPress Newsletters | 19 | 2,293 | 1,422 | 1k+ | Output is not escaped | ||
| #21 | SureCart – Ecommerce Made Easy For Selling Physical Products, Digital Downloads, Subscriptions, Donations, & Payments | 19 | 543 | 1,150 | 80k+ | Non-prefixed global variable | ||
| #22 | WP Email Template | 19 | 344 | 345 | 2k+ | Exception output is not escaped | ||
| #23 | WPOSS阿里云对象存储 | 19 | 269 | 315 | 900 | Non-prefixed namespace | ||
| #24 | WPQiNiu七牛云对象存储 | 19 | 138 | 612 | 400 | Non-prefixed global variable | ||
| #25 | AweBooking – Hotel Booking System | 20 | 309 | 514 | 1k+ | Non-prefixed global variable | ||
| #26 | Brizy – Page Builder | 20 | 585 | 726 | 60k+ | Output is not escaped | ||
| #27 | Broadstreet | 20 | 434 | 273 | 800 | Output is not escaped | ||
| #28 | Post Form – Registration Form – Profile Form for User Profiles – Frontend Content Forms for User Submissions (UGC) | 20 | 736 | 2,112 | 900 | Non-prefixed global variable | ||
| #29 | Download Monitor | 20 | 420 | 1,242 | 80k+ | Non-prefixed hook name | ||
| #30 | Duplicator – Backups & Migration Plugin – Cloud Backups, Scheduled Backups, & More | 20 | 2,878 | 1,988 | 1m+ | Non-prefixed global variable | ||
| #31 | Event Organiser | 20 | 1,104 | 544 | 20k+ | Text Domain Mismatch | ||
| #32 | EventPrime – Events Calendar, Bookings, Tickets & AI | 20 | 846 | 4,224 | 7k+ | Non-prefixed global variable | ||
| #33 | MBE eShip | 20 | 527 | 740 | 1k+ | Non-prefixed global variable | ||
| #34 | MAS Videos | 20 | 519 | 1,693 | 1k+ | Non-prefixed global variable | ||
| #35 | Microthemer Lite – Visual Editor to Customize CSS | 20 | 1,004 | 1,699 | 10k+ | Non-prefixed global variable | ||
| #36 | Nimble Page Builder | 20 | 1,591 | 1,684 | 30k+ | Missing Arg Domain | ||
| #37 | Pix por Piggly (para Woocommerce) | 20 | 547 | 195 | 4k+ | Exception output is not escaped | ||
| #38 | Powered Cache – Caching and Optimization for WordPress – Easily Improve PageSpeed & Web Vitals Score | 20 | 147 | 231 | 3k+ | Exception output is not escaped | ||
| #39 | Pronamic Pay | 20 | 266 | 1,078 | 2k+ | Non-prefixed global variable | ||
| #40 | Razorpay Payment Button Plugin | 20 | 486 | 94 | 2k+ | Exception output is not escaped | ||
| #41 | Razorpay Payment Button Elementor Plugin | 20 | 479 | 62 | 1k+ | Exception output is not escaped | ||
| #42 | Remove Add to Cart WooCommerce | 20 | 616 | 1,378 | 4k+ | Non-prefixed global variable | ||
| #43 | Membership Plugin – Kadence Memberships | 20 | 5,089 | 3,005 | 9k+ | Text Domain Mismatch | ||
| #44 | Restrict User Access – Ultimate Membership & Content Protection | 20 | 977 | 1,848 | 10k+ | Non-prefixed global variable | ||
| #45 | Robin Image Optimizer – Unlimited Image Optimization, WebP & AVIF | 20 | 556 | 543 | 100k+ | Output is not escaped | ||
| #46 | Events Manager – OpenStreetMaps | 20 | 559 | 444 | 600 | Output is not escaped | ||
| #47 | Booster for WooCommerce – PDF Invoices, Abandoned Cart, Variation Swatches & 100+ Tools | 20 | 787 | 3,416 | 30k+ | Non-prefixed global variable | ||
| #48 | WP Minify Fix | 20 | 306 | 380 | 800 | Output is not escaped | ||
| #49 | Premium Packages – Sell Digital Products Securely | 20 | 2,043 | 2,306 | 2k+ | Non-prefixed global variable | ||
| #50 | Backup Migration | 21 | 999 | 1,081 | 80k+ | Non-prefixed global variable |
