PluginScore

WordPress.Security.EscapeOutput.ExceptionNotEscaped

Exception output is not escaped

An exception message or related exception value is printed without escaping.

critical weight

Why It Shows Up

The scan found exception data being displayed directly in HTML output.

Why It Matters

Exception messages can include file paths, request values, remote API responses, or database details. Printing them raw can expose information or create XSS risk.

How to Fix

  • Use `esc_html()` or another context-appropriate escaping function before displaying exception text.
  • Show a generic user-facing message and log the detailed exception for administrators or developers.
  • Do not print stack traces, paths, or raw remote responses on public pages.

References

WordPress escaping functions

Affected Plugins

RankPluginScoreErrorsWarningsInstallsAddedUpdatedTop Issue
#751Smush – Image Optimization, Compression, Lazy Load, WebP & CDN252445681m+Non-prefixed hook name
#752WP Statistics – Simple, privacy-friendly Google Analytics alternative256102,465600k+Non-prefixed global variable
#753WP TripAdvisor Review Slider251,0532,5778k+Non-prefixed global variable
#754Team Members Showcase255911,4944k+Non-prefixed global variable
#755Backup, Restore and Migrate your sites with XCloner2523886410k+Input is not sanitized
#756YeeMail — Email Template Builder & Customizer25606222600wp function not compatible with requires wp
#757YT Player – Embed and Customize Video Players253,1632611k+Output is not escaped
#758ActiveCampaign for WooCommerce265411906k+Exception output is not escaped
#759AfterShip Tracking – All-In-One WooCommerce Order Tracking (Free plan available)262862917k+Text Domain Mismatch
#760Bangladeshi Payments Mobile – QR Code & Transaction Reports265351,2801k+Non-prefixed global variable
#761Blog Floating Button267052409k+Output is not escaped
#762Booking Manager – Sync WP Booking Calendar – Import Events, Export Bookings to ICS Calendar265262635k+Output is not escaped
#763Charitable – Donation Plugin for WordPress – Fundraising with Recurring Donations & More269727010k+error log error log
#764Conditional Logic for Woo Product Add-ons265751,352500Non-prefixed global variable
#765Translate WordPress with ConveyThis – AI Multilingual Plugin261592971k+Non-prefixed global variable
#766Easy Post Views Count265341,1802k+Non-prefixed global variable
#767ELEX WooCommerce Google Shopping (Google Product Feed)262262421k+Text Domain Mismatch
#768ezCache2612728810k+Direct Query
#769FlagShip WooCommerce Shipping26495188400Non Singular String Literal Domain
#770FuseWP – WordPress User Sync to Email List & Marketing Automation (Mailchimp, Constant Contact, ActiveCampaign etc.)265944172k+Exception output is not escaped
#771Hide Admin Bar Based on User Roles265491,34520k+Non-prefixed global variable
#772Icegram Collect – Easy Form, Lead Collection and Subscription plugin264232922k+Output is not escaped
#773Image SEO – AI-Driven Image SEO Optimizer263503271k+Text Domain Mismatch
#774Integrate Razorpay for Contact Form 72615297500curl curl setopt
#775Kirki – Freeform Page Builder, Website Builder & Customizer26192799500k+Nonce verification recommended
#776Klarna for WooCommerce2628450730k+Dynamic hook name
#777Landing Page Cat – Coming Soon & Maintenance Pages2691180600Non-prefixed class
#778Media File Renamer: Rename for better SEO (AI-Powered)2615417040k+Direct Query
#779Omise Payments263582562k+Output is not escaped
#780Post List Designer – Category Post, Recent Post, Post List265421,3201k+Non-prefixed global variable
#781Premmerce User Roles265971,357600Non-prefixed global variable
#782Pressidium Cookie Consent262039510k+Exception output is not escaped
#783RestaurantPress26265518600Output is not escaped
#784Role Based Pricing for Woo by Meow Crew265481,3542k+Non-prefixed global variable
#785Sliced Invoices – WordPress Invoice Plugin266844555k+Output is not escaped
#786Carousel, Recent Post Slider and Banner Slider265281,4098k+Non-prefixed global variable
#787StoreGrowth: Smart Sales Booster for WooCommerce | BOGO, Upsells, Direct Checkout, Quick View, Side Cart261254202k+Non-prefixed global variable
#788SV Proven Expert26747380900Output is not escaped
#789Virtue/Ascend/Pinnacle Toolkit2660530030k+Output is not escaped
#790Premmerce SEO for WooCommerce265501,2851k+Non-prefixed global variable
#791Set Price Note (Units, Offers, Editions) for WooCommerce265961,307800Non-prefixed global variable
#792Shipping Method Display Style for WooCommerce265291,3082k+Non-prefixed global variable
#793XL NMI Gateway for WooCommerce266954361k+Text Domain Mismatch
#794Faktur Pro for WooCommerce264162181k+Text Domain Mismatch
#795WP Flashy Marketing Automation264321862k+Text Domain Mismatch
#796Accordions – Responsive Accordion & FAQ Plugin for WordPress275541581k+Text Domain Mismatch
#797Arconix FAQ275522016k+Text Domain Mismatch
#798Church Content – Sermons, Events and More271344104k+Non-prefixed function
#799Divi Collage275161,183700Non-prefixed global variable
#800Custom Scrollbar271841912k+Output is not escaped