PluginScore

WordPress.Security.EscapeOutput.ExceptionNotEscaped

Exception output is not escaped

An exception message or related exception value is printed without escaping.

critical weight

Why It Shows Up

The scan found exception data being displayed directly in HTML output.

Why It Matters

Exception messages can include file paths, request values, remote API responses, or database details. Printing them raw can expose information or create XSS risk.

How to Fix

  • Use `esc_html()` or another context-appropriate escaping function before displaying exception text.
  • Show a generic user-facing message and log the detailed exception for administrators or developers.
  • Do not print stack traces, paths, or raw remote responses on public pages.

References

WordPress escaping functions

Affected Plugins

RankPluginScoreErrorsWarningsInstallsAddedUpdatedTop Issue
#451Fattura2424312333400Output is not escaped
#452FluentCRM – Email Newsletter, Automation, Email Marketing, Email Campaigns, Optins, Leads, and CRM Solution2419375380k+Direct Query
#453Food Store – Online Food Delivery & Pickup248621,9411k+Non-prefixed global variable
#454Force Sell for WooCommerce24697455600Text Domain Mismatch
#455Formidable PRO2PDF242184771k+Non-prefixed global variable
#456Forminator Forms – Contact Form, Payment Form & Custom Form Builder248261,314600k+Non-prefixed global variable
#457Fuse Social Floating Sidebar241,8381,57810k+Non-prefixed global variable
#458FV Player 8243231,3831k+Non-prefixed function
#459Photo Gallery – Responsive Image Galleries by Supsystic242409120k+Text Domain Mismatch
#460GD Mail Queue24502582700Output is not escaped
#461Genealogical Tree – Family Tree & Ancestry for WordPress245601,641600Non-prefixed global variable
#462GEO my WP245542,0893k+Non-prefixed hook name
#463Assets manager, dequeue scripts, dequeue styles for WordPress245922552k+Output is not escaped
#464Simple Calendar – Google Calendar Plugin242,05359250k+Missing direct file access protection
#465Easy Google Maps241,76438920k+Non Singular String Literal Domain
#466GS Behance Portfolio – Display Projects, Gallery & Slider248551,617400Non-prefixed global variable
#467Hide Shipping Method For WooCommerce249461,44710k+Non-prefixed global variable
#468HT Mega Addons for Elementor – Elementor Widgets & Template Builder2412,3521,47470k+Text Domain Mismatch
#469Hummingbird Performance – Cache & Page Speed Optimization for Core Web Vitals | Critical CSS | Minify CSS | Defer CSS Javascript | CDN243,41086670k+Text Domain Mismatch
#470Import and export users and customers241,04035770k+Unsafe printing function
#471Infinite Uploads – Offload Media and Video to Cloud Storage24586722800Direct Query
#472Keap Official Opt-in Forms248291,0461k+Non-prefixed global variable
#473Social Slider Feed – Social Media Feed & Gallery Widgets2492970720k+Non-prefixed global variable
#474InstaWP Connect – 1-click WP Staging & Migration2425381140k+Non-prefixed global variable
#475Dynamics 365 Integration24383166600Output is not escaped
#476Joli Table Of Contents246531,7557k+Non-prefixed global variable
#477Kenta Blocks – Responsive Blocks and block templates library245641,4052k+Non-prefixed global variable
#478KiviCare – Clinic & Patient Management System (EHR)242238802k+Direct Query
#479Appointment Booking Plugin – LatePoint | Calendar & Scheduling for WordPress241,855953100k+Output is not escaped
#480LearnPress – Backup & Migration Tool243854695k+Output is not escaped
#481Local Delivery Drivers for WooCommerce241,8321,483900Non-prefixed global variable
#482Event Booking Manager for WooCommerce – Registration, RSVP, Calendar & Tickets249692,1407k+Non-prefixed global variable
#483Generate Images (AI) – Magic Post Thumbnail241,9401,7616k+Non-prefixed global variable
#484Mail Mint – Email Marketing, Newsletter, Email Automation & WooCommerce Emails244,6961,4805k+Text Domain Mismatch
#485Mailchimp for WooCommerce24523663200k+Non-prefixed global variable
#486MailerPress – Newsletter, email marketing & AI automation248053,9311k+Direct Query
#487Mailjet Email Marketing2443520610k+Unsafe printing function
#488Mang Board WP241,2134,7209k+Non-prefixed global variable
#489Admin Tweaks241,507206900Text Domain Mismatch
#490Marketing Automation24440677600Non-prefixed global variable
#491Mass Pages/Posts Creator247361,3641k+Non-prefixed global variable
#492Receive customer payments on Woocommerce245491,4191k+Non-prefixed global variable
#493Timetable and Event Schedule by MotoPress2445623230k+Output is not escaped
#494MT Addons for Elementor243,0731,4422k+Text Domain Mismatch
#495Musician's Pack for Elementor – Music Website Widgets & Templates241,725228400Text Domain Mismatch
#496Music Player for Elementor – Audio Player & Podcast Player246081,30210k+Non-prefixed global variable
#497MxChat – AI Chatbot & Content Generation for WordPress243,2301,4052k+Text Domain Mismatch
#498New User Approve246521,41520k+Non-prefixed global variable
#499Newsletter – Send awesome emails from WordPress248982,219200k+Non-prefixed global variable
#500Newsletter Subscription Form – User Subscriptions Form, Capture Email243858291k+Non-prefixed global variable