PluginScore

WordPress.Security.EscapeOutput.ExceptionNotEscaped

Exception output is not escaped

An exception message or related exception value is printed without escaping.

critical weight

Why It Shows Up

The scan found exception data being displayed directly in HTML output.

Why It Matters

Exception messages can include file paths, request values, remote API responses, or database details. Printing them raw can expose information or create XSS risk.

How to Fix

  • Use `esc_html()` or another context-appropriate escaping function before displaying exception text.
  • Show a generic user-facing message and log the detailed exception for administrators or developers.
  • Do not print stack traces, paths, or raw remote responses on public pages.

References

WordPress escaping functions

Affected Plugins

RankPluginScoreErrorsWarningsInstallsAddedUpdatedTop Issue
#651Gallery Images Ape255883411k+Output is not escaped
#652Simple Giveaways – Grow your business, email lists and traffic with contests259562,384400Non-prefixed global variable
#653WPBruiser {no- Captcha anti-Spam}2564625910k+Non Singular String Literal Domain
#654Site Kit by Google – Analytics, Search Console, AdSense, Speed251,3042425m+Missing direct file access protection
#655Sitemap by BestWebSoft – WordPress XML Site Map Page Generator Plugin2560820720k+Text Domain Mismatch
#656Team Members – A WordPress Team Plugin with Gallery, Grid, Carousel, Slider, Table, List, and More251,7862,2202k+Non-prefixed global variable
#657Solid Testimonials – Testimonial Slider, Video Testimonials & Customer Reviews256451,5851k+Non-prefixed global variable
#658Hardcore Google Fonts Localizer25331261800Text Domain Mismatch
#659Cool Author Box – For Widget and Post Content258531,379600Non-prefixed global variable
#660Icegram Collect – Easy Form, Lead Collection and Subscription plugin254242902k+Output is not escaped
#661Independent Analytics – WordPress Analytics Plugin251,1482,293100k+Non-prefixed global variable
#662Index WP MySQL For Speed2525025550k+Output is not escaped
#663IP Location Block2552162410k+Output is not escaped
#664IP Locator25482211600Text Domain Mismatch
#665JobWP – Job Board, Job Listing, Career Page and Recruitment Plugin251,5411,5781k+Non-prefixed global variable
#666kk Star Ratings – Rate Post & Collect User Feedbacks257721,38870k+Non-prefixed global variable
#667Knit Pay – Cashfree, Instamojo, Razorpay, PayPal and more254,0191,2652k+Text Domain Mismatch
#668Limit Login Attempts Security – Login Security, 2FA, Firewall, Brute Force Prevention256176141m+Unsafe printing function
#669Local Pickup for WooCommerce255471,3891k+Non-prefixed global variable
#670Loginizer258145041m+Output is not escaped
#671Logo Showcase – Responsive Logo Carousel, Logo Slider & Logo Grid256561,5065k+Non-prefixed global variable
#672Bulk Page Generator – LPagery256701,9263k+Non-prefixed global variable
#673M Chart255611,4653k+Non-prefixed global variable
#674MaxButtons – Create buttons2562640470k+Output is not escaped
#675Media Cloud Sync251,0952741k+Exception output is not escaped
#676Create251,6377646k+Text Domain Mismatch
#677Minimum and Maximum Quantity for WooCommerce255561,4363k+Non-prefixed global variable
#678Multibanco / MB Way / Payshop / Cofidis Pay (by LUSOPAY) for WooCommerce25492216400Text Domain Mismatch
#679MyFatoorah – WooCommerce25191892k+Output is not escaped
#680Nexter Extension – Security, Performance, Code Snippets & Site Toolkit2519871210k+Nonce verification recommended
#681NotificationX – FOMO, Live Sales Notification, WooCommerce Sales Popup, GDPR, Social Proof, Announcement Banner & Floating Notification Bar2525740040k+Non-prefixed hook name
#682Notifications for Forms & WordPress Actions253092821k+Text Domain Mismatch
#683NOWPayments for WooCommerce – Crypto Payment Gateway255341,3064k+Non-prefixed global variable
#684Object Sync for Salesforce25192296500Non-prefixed global variable
#685Password Protected — Lock Entire Site, Pages, Posts, Categories, and Partial Content256811,513300k+Non-prefixed global variable
#686PDF Importer for WPForms25332329400Non-prefixed global variable
#687PDF & Print by BestWebSoft – WordPress Posts and Pages PDF Generator Plugin251,0841,2969k+Non-prefixed global variable
#688Plover Kit – Blocks, Patterns, Responsive Layout and Gutenberg Editor Enhancements256851,3823k+Non-prefixed global variable
#689Post Carousel Divi256861,3012k+Non-prefixed global variable
#690Post Snippets – Custom WordPress Code Snippets Customizer258081,65420k+Non-prefixed global variable
#691Premmerce257121,411500Non-prefixed global variable
#692Premmerce Redirect Manager257561,407500Non-prefixed global variable
#693Premmerce Product Search for WooCommerce255961,350900Non-prefixed global variable
#694Premmerce Wholesale Pricing for WooCommerce256351,377400Non-prefixed global variable
#695QuadMenu – Mega Menu252,12845510k+Output is not escaped
#696Qyrr – simply and modern QR-Code creation255311,3122k+Non-prefixed global variable
#697Rate limiting for Contact Form 7255471,306500Non-prefixed global variable
#698Really Simple Featured Video – Featured Video Support for Posts, Pages & WooCommerce Products258111,4945k+Non-prefixed global variable
#699Restrict – membership, site, content and user access restrictions for WordPress255391,4012k+Non-prefixed global variable
#700BerqWP – All-In-One Optimization for Core Web Vitals, Cache, CDN, Images, CSS & JavaScript251985014k+Non-prefixed global variable