WordPress.Security.EscapeOutput.ExceptionNotEscaped
Exception output is not escaped
An exception message or related exception value is printed without escaping.
Why It Shows Up
The scan found exception data being displayed directly in HTML output.
Why It Matters
Exception messages can include file paths, request values, remote API responses, or database details. Printing them raw can expose information or create XSS risk.
How to Fix
- Use `esc_html()` or another context-appropriate escaping function before displaying exception text.
- Show a generic user-facing message and log the detailed exception for administrators or developers.
- Do not print stack traces, paths, or raw remote responses on public pages.
References
Affected Plugins
| Rank | Plugin | Score | Errors | Warnings | Installs | Added | Updated | Top Issue |
|---|---|---|---|---|---|---|---|---|
| #801 | Divi Collage | 27 | 516 | 1,183 | 700 | Non-prefixed global variable | ||
| #802 | Custom Scrollbar | 27 | 184 | 191 | 2k+ | Output is not escaped | ||
| #803 | Cyrlitera – Transliteration of Links and File Names | 27 | 453 | 204 | 40k+ | Output is not escaped | ||
| #804 | Embedder for Google Reviews | 27 | 531 | 1,333 | 6k+ | Non-prefixed global variable | ||
| #805 | CM Tooltip Glossary | 27 | 611 | 188 | 7k+ | Output is not escaped | ||
| #806 | Everest Backup – WordPress Cloud Backup, Migration, Restore & Cloning Plugin | 27 | 122 | 135 | 3k+ | Non-prefixed global variable | ||
| #807 | Extra Product Options for WooCommerce | 27 | 548 | 1,342 | 600 | Non-prefixed global variable | ||
| #808 | Foxtool All-in-One: Contact chat button, Custom login, Media optimize images | 27 | 1,629 | 360 | 7k+ | Unsafe printing function | ||
| #809 | Login for Google Apps | 27 | 139 | 85 | 10k+ | Exception output is not escaped | ||
| #810 | Gravity Forms + Stripe | 27 | 368 | 210 | 600 | Output is not escaped | ||
| #811 | Hester Core | 27 | 253 | 103 | 10k+ | Output is not escaped | ||
| #812 | HM Multiple Roles | 27 | 537 | 1,287 | 1k+ | Non-prefixed global variable | ||
| #813 | Import Eventbrite Events | 27 | 156 | 575 | 3k+ | Non-prefixed global variable | ||
| #814 | My Private Site – Make Your Whole Site Private, Force Login & Block Registration Spam | 27 | 713 | 321 | 10k+ | Text Domain Mismatch | ||
| #815 | Liza Widget For Spotify and Elementor | 27 | 609 | 1,287 | 1k+ | Non-prefixed global variable | ||
| #816 | Loco Translate | 27 | 451 | 225 | 1m+ | Output is not escaped | ||
| #817 | MW WP Form | 27 | 334 | 219 | 200k+ | Output is not escaped | ||
| #818 | Nextend Social Login and Register | 27 | 1,668 | 243 | 200k+ | Output is not escaped | ||
| #819 | Tussendoor – Open RDW | 27 | 301 | 140 | 600 | Text Domain Mismatch | ||
| #820 | Packlink PRO for WooCommerce | 27 | 132 | 160 | 20k+ | Non-prefixed global variable | ||
| #821 | Restrict for Elementor | 27 | 530 | 1,223 | 900 | Non-prefixed global variable | ||
| #822 | Sign-up Sheets | 27 | 325 | 363 | 1k+ | Output is not escaped | ||
| #823 | Hubbub Lite – Fast, free social sharing and follow buttons | 27 | 337 | 172 | 30k+ | Text Domain Mismatch | ||
| #824 | SV Tracking Manager | 27 | 968 | 129 | 1k+ | Output is not escaped | ||
| #825 | Terms & Conditions Per Product | 27 | 533 | 1,336 | 800 | Non-prefixed global variable | ||
| #826 | Transbank Webpay | 27 | 198 | 211 | 10k+ | Non-prefixed global variable | ||
| #827 | Tutor LMS – Migration Tool | 27 | 139 | 341 | 1k+ | Direct Query | ||
| #828 | Ultimate Watermark – Image Watermark, Image Protection & Bulk Watermarking | 27 | 164 | 303 | 1k+ | Nonce verification recommended | ||
| #829 | WP Events Manager | 27 | 294 | 415 | 30k+ | Output is not escaped | ||
| #830 | WP Job Manager | 27 | 93 | 582 | 80k+ | Non-prefixed hook name | ||
| #831 | WP Activity Log | 27 | 96 | 230 | 300k+ | Nonce verification recommended | ||
| #832 | WP Chat App | 27 | 120 | 274 | 100k+ | Alternative PHP tag found | ||
| #833 | WPBase Cache | 27 | 189 | 113 | 2k+ | Text Domain Mismatch | ||
| #834 | Ultimate Addons for SiteOrigin | 28 | 525 | 189 | 7k+ | Text Domain Mismatch | ||
| #835 | AForms — Form Builder for Price Calculator & Cost Estimation | 28 | 564 | 95 | 3k+ | Text Domain Mismatch | ||
| #836 | AJAX Login and Registration modal popup + inline form | 28 | 157 | 261 | 3k+ | Output is not escaped | ||
| #837 | Code Engine – PHP Snippets, AI Functions & Automation for WordPress | 28 | 124 | 96 | 700 | Non Singular String Literal Domain | ||
| #838 | Maspik – Ultimate Spam Protection | 28 | 212 | 862 | 30k+ | Missing nonce verification | ||
| #839 | Database Cleaner | 28 | 137 | 297 | 10k+ | Direct Query | ||
| #840 | easy.jobs – AI powered Job Listing, Job Board, Career Page, Recruitment & Hiring Solution | 28 | 405 | 924 | 4k+ | Missing nonce verification | ||
| #841 | Educare – Students & Result Management System | 28 | 1,114 | 1,043 | 800 | Missing nonce verification | ||
| #842 | Event Tickets Manager for WooCommerce | 28 | 181 | 648 | 1k+ | Non-prefixed global variable | ||
| #843 | Expand Divi | 28 | 91 | 100 | 1k+ | Non-prefixed global variable | ||
| #844 | FAPI Member | 28 | 279 | 153 | 500 | Exception output is not escaped | ||
| #845 | گیتلند | درگاه پرداخت هوشمند گیتلند | 28 | 327 | 235 | 3k+ | Output is not escaped | ||
| #846 | Kadence Starter Templates — Predesigned Website Templates | 28 | 312 | 215 | 200k+ | Missing Arg Domain | ||
| #847 | Laposta Signup Basic | 28 | 276 | 67 | 2k+ | Output is not escaped | ||
| #848 | WP to LinkedIn Auto Publish | 28 | 734 | 250 | 900 | Unsafe printing function | ||
| #849 | Maven Algolia | 28 | 148 | 89 | 6k+ | Non Singular String Literal Domain | ||
| #850 | My auctions allegro | 28 | 483 | 235 | 500 | Non Singular String Literal Domain |
