WordPress.Security.EscapeOutput.ExceptionNotEscaped
Exception output is not escaped
An exception message or related exception value is printed without escaping.
Why It Shows Up
The scan found exception data being displayed directly in HTML output.
Why It Matters
Exception messages can include file paths, request values, remote API responses, or database details. Printing them raw can expose information or create XSS risk.
How to Fix
- Use `esc_html()` or another context-appropriate escaping function before displaying exception text.
- Show a generic user-facing message and log the detailed exception for administrators or developers.
- Do not print stack traces, paths, or raw remote responses on public pages.
References
Affected Plugins
| Rank | Plugin | Score | Errors | Warnings | Installs | Added | Updated | Top Issue |
|---|---|---|---|---|---|---|---|---|
| #701 | SimpLy Gallery | 25 | 532 | 1,422 | 40k+ | Non-prefixed global variable | ||
| #702 | Appointment Booking Calendar — Simply Schedule Appointments Booking Plugin | 25 | 958 | 738 | 60k+ | Text Domain Mismatch | ||
| #703 | Simply Static – The Static Site Generator | 25 | 168 | 501 | 30k+ | Non-prefixed hook name | ||
| #704 | Smart Image Resize for WooCommerce | 25 | 582 | 404 | 7k+ | Text Domain Mismatch | ||
| #705 | Smart phone field for Gravity Forms | 25 | 540 | 1,316 | 6k+ | Non-prefixed global variable | ||
| #706 | Spice Blocks | 25 | 536 | 1,300 | 1k+ | Non-prefixed global variable | ||
| #707 | STAGGS – Product Configurator Toolkit | 25 | 626 | 2,180 | 400 | Non-prefixed global variable | ||
| #708 | SureDash – Community, Courses & Member Dashboard | 25 | 422 | 805 | 1k+ | Non-prefixed global variable | ||
| #709 | OttoKit: All-in-One Automation Platform | 25 | 1,536 | 1,825 | 90k+ | Missing direct file access protection | ||
| #710 | TablePress – Tables in WordPress made easy | 25 | 847 | 2,174 | 600k+ | Non-prefixed global variable | ||
| #711 | Tamara Checkout | 25 | 601 | 228 | 2k+ | Exception output is not escaped | ||
| #712 | Taskbuilder – Project Management & Task Management Tool With Kanban Board | 25 | 127 | 4,332 | 800 | Non-prefixed global variable | ||
| #713 | Tax Exemption for WooCommerce | 25 | 552 | 1,402 | 700 | Non-prefixed global variable | ||
| #714 | TemplateSpare – 1000+ WordPress Starter Templates & Full Site Migration Tool | 1-Click Import/Export & No-Code Builder | 25 | 705 | 1,587 | 10k+ | Non-prefixed global variable | ||
| #715 | Timeline Express | 25 | 531 | 147 | 9k+ | Text Domain Mismatch | ||
| #716 | TrackShip for WooCommerce | 25 | 421 | 957 | 6k+ | Non-prefixed global variable | ||
| #717 | TrueBooker – Appointment Booking and Scheduler System | 25 | 529 | 2,746 | 600 | Non-prefixed global variable | ||
| #718 | Ultimate Blocks – 25+ Gutenberg Blocks for Block Editor | 25 | 691 | 1,581 | 50k+ | Non-prefixed global variable | ||
| #719 | Social Media Share Buttons & Social Sharing Icons | 25 | 2,433 | 1,383 | 100k+ | Unsafe printing function | ||
| #720 | Social Share Icons & Social Share Buttons | 25 | 2,365 | 1,357 | 10k+ | Output is not escaped | ||
| #721 | VikAppointments Services Booking Calendar | 25 | 9,753 | 5,207 | 500 | Output is not escaped | ||
| #722 | VikBooking Hotel Booking Engine & PMS | 25 | 13,244 | 8,314 | 8k+ | Output is not escaped | ||
| #723 | VikRentCar Car Rental Management System | 25 | 5,537 | 5,048 | 4k+ | Non-prefixed global variable | ||
| #724 | VikRestaurants Table Reservations and Take-Away | 25 | 11,644 | 4,932 | 600 | Output is not escaped | ||
| #725 | 3D viewer by Visody | 25 | 832 | 1,322 | 1k+ | Non-prefixed global variable | ||
| #726 | WC Disable Zoom / Lightbox features | 25 | 529 | 1,297 | 700 | Non-prefixed global variable | ||
| #727 | Product Customer List for WooCommerce | 25 | 610 | 1,334 | 9k+ | Non-prefixed global variable | ||
| #728 | weDocs: AI Powered Knowledge Base, Docs, Documentation, Wiki & AI Chatbot | 25 | 279 | 518 | 4k+ | Non-prefixed global variable | ||
| #729 | weForms – Easy Drag & Drop Contact Form Builder For WordPress | 25 | 916 | 450 | 10k+ | Output is not escaped | ||
| #730 | Secure Gateway for Authorize.net and WooCommerce by Pledged Plugins | 25 | 907 | 1,418 | 10k+ | Non-prefixed global variable | ||
| #731 | Digital Goods (Checkout Field Editor) for WooCommerce Checkout | 25 | 539 | 1,479 | 3k+ | Non-prefixed global variable | ||
| #732 | Dynamic Pricing and Discount Rules for WooCommerce | 25 | 531 | 1,569 | 600 | Non-prefixed global variable | ||
| #733 | Flat Rate Shipping Method for WooCommerce | 25 | 1,242 | 1,778 | 5k+ | Non-prefixed global variable | ||
| #734 | PDF Builder for WooCommerce. Create invoices,packing slips and more | 25 | 372 | 503 | 2k+ | Non-prefixed global variable | ||
| #735 | Payment Plugins for Stripe WooCommerce | 25 | 348 | 779 | 100k+ | Non-prefixed global variable | ||
| #736 | Pay with Vipps and MobilePay for WooCommerce | 25 | 846 | 514 | 5k+ | Output is not escaped | ||
| #737 | Wordfence Login Security | 25 | 248 | 418 | 70k+ | Output is not escaped | ||
| #738 | WordPress Importer | 25 | 238 | 110 | 2m+ | Output is not escaped | ||
| #739 | WP 2FA – Two-factor authentication for WordPress | 25 | 283 | 716 | 100k+ | Non-prefixed global variable | ||
| #740 | Super Page Cache – Cloudflare Cache, Page Speed & Core Web Vitals | 25 | 137 | 353 | 60k+ | Input is not sanitized | ||
| #741 | WP Coupons and Deals – WordPress Coupon Plugin | 25 | 914 | 1,460 | 1k+ | Non-prefixed global variable | ||
| #742 | WP Data Access – App Builder for Tables, Forms, Charts, Maps & Dashboards | 25 | 1,431 | 1,270 | 10k+ | Output is not escaped | ||
| #743 | WP Review Slider | 25 | 1,186 | 2,279 | 6k+ | Non-prefixed global variable | ||
| #744 | WP Go Maps – Google Map, OpenStreetMap, Leaflet Map | 25 | 4,996 | 1,008 | 300k+ | Unsafe printing function | ||
| #745 | WP Google Review Slider | 25 | 1,367 | 2,584 | 30k+ | Non-prefixed global variable | ||
| #746 | WP Encryption – No.1 HTTPS plugin & One Click Free SSL Cert, HTTPS Redirect, Security | 25 | 727 | 1,554 | 50k+ | Non-prefixed global variable | ||
| #747 | Nested Pages | 25 | 674 | 560 | 90k+ | Non-prefixed global variable | ||
| #748 | WP-Polls | 25 | 618 | 639 | 40k+ | Unsafe printing function | ||
| #749 | Perfect Images: Regenerate Thumbnails, Image Sizes, WebP & AVIF | 25 | 158 | 118 | 60k+ | Non-prefixed global variable | ||
| #750 | SlimStat Analytics | 25 | 1,177 | 870 | 70k+ | Exception output is not escaped |
