WordPress.Security.EscapeOutput.ExceptionNotEscaped
Exception output is not escaped
An exception message or related exception value is printed without escaping.
Why It Shows Up
The scan found exception data being displayed directly in HTML output.
Why It Matters
Exception messages can include file paths, request values, remote API responses, or database details. Printing them raw can expose information or create XSS risk.
How to Fix
- Use `esc_html()` or another context-appropriate escaping function before displaying exception text.
- Show a generic user-facing message and log the detailed exception for administrators or developers.
- Do not print stack traces, paths, or raw remote responses on public pages.
References
Affected Plugins
| Rank | Plugin | Score | Errors | Warnings | Installs | Added | Updated | Top Issue |
|---|---|---|---|---|---|---|---|---|
| #851 | Notification – Custom Notifications and Alerts for WordPress | 28 | 186 | 219 | 10k+ | Non-prefixed global variable | ||
| #852 | Opal Service | 28 | 339 | 329 | 900 | Non-prefixed global variable | ||
| #853 | Store Hours for WooCommerce | 28 | 525 | 60 | 2k+ | Output is not escaped | ||
| #854 | Perfect Brands for WooCommerce | 28 | 112 | 143 | 40k+ | Non-prefixed constant | ||
| #855 | PHP Browser Detection | 28 | 68 | 49 | 600 | Non-prefixed function | ||
| #856 | Autopay | 28 | 769 | 334 | 3k+ | Text Domain Mismatch | ||
| #857 | Podcast Importer SecondLine | 28 | 356 | 169 | 4k+ | Text Domain Mismatch | ||
| #858 | Payment Plugins for PayPal WooCommerce | 28 | 229 | 244 | 80k+ | Non-prefixed hook name | ||
| #859 | Redis Object Cache | 28 | 151 | 103 | 400k+ | Exception output is not escaped | ||
| #860 | Brilliant Web-to-Lead for Salesforce | 28 | 247 | 244 | 2k+ | Text Domain Mismatch | ||
| #861 | Transliterator – Multilingual and Multi-script Text Conversion | 28 | 305 | 322 | 3k+ | Output is not escaped | ||
| #862 | Terms descriptions | 28 | 222 | 423 | 1k+ | Non-prefixed function | ||
| #863 | Thim Kit for Elementor – Pre-built Templates & Widgets for Elementor | 28 | 291 | 292 | 20k+ | Output is not escaped | ||
| #864 | Ultimate FAQ Accordion Plugin | 28 | 386 | 227 | 30k+ | Unsafe printing function | ||
| #865 | WeeConnectPay – Clover Payment Gateway for WooCommerce | 28 | 179 | 171 | 500 | Exception output is not escaped | ||
| #866 | PayZen for WooCommerce | 28 | 258 | 214 | 600 | Output is not escaped | ||
| #867 | Dynamic Product Gallery for WooCommerce | 28 | 414 | 301 | 1k+ | Output is not escaped | ||
| #868 | Email Inquiry & Cart Options for WooCommerce | 28 | 181 | 273 | 800 | Output is not escaped | ||
| #869 | Product Sort and Display for WooCommerce | 28 | 190 | 229 | 2k+ | Output is not escaped | ||
| #870 | Connect Matomo – Analytics Dashboard for WordPress | 28 | 100 | 102 | 60k+ | Missing Translators Comment | ||
| #871 | WPify Woo – Withdrawal, CRN/VAT, QR payments, Heureka and more for WooCommerce | 28 | 177 | 226 | 5k+ | Output is not escaped | ||
| #872 | WPO365 | SEAMLESS WORDPRESS + MICROSOFT INTEGRATION (WPO365 | LOGIN) | 28 | 209 | 217 | 10k+ | Exception output is not escaped | ||
| #873 | WPS Bidouille | 28 | 472 | 215 | 10k+ | Output is not escaped | ||
| #874 | WP Synchro – The Ultimate WordPress Migration Tool | 28 | 243 | 244 | 2k+ | Missing Translators Comment | ||
| #875 | YITH WooCommerce Product Bundles | 28 | 404 | 1,480 | 3k+ | Non-prefixed global variable | ||
| #876 | Attribute Stock for WooCommerce – Shared Stock & Variable Quantities (Lite Version) | 29 | 481 | 313 | 2k+ | Text Domain Mismatch | ||
| #877 | Bitcoin Payments – Blockonomics | 29 | 208 | 227 | 2k+ | Output is not escaped | ||
| #878 | Plugin BlueX for WooCommerce | 29 | 431 | 216 | 2k+ | Text Domain Mismatch | ||
| #879 | BNE Testimonials | 29 | 521 | 102 | 1k+ | Output is not escaped | ||
| #880 | Chained Quiz | 29 | 1,132 | 721 | 1k+ | Text Domain Mismatch | ||
| #881 | CloudSecure WP Security | 29 | 74 | 350 | 100k+ | Request data is not unslashed | ||
| #882 | Display Tweets | 29 | 135 | 135 | 900 | Non-prefixed global variable | ||
| #883 | Document Gallery | 29 | 183 | 98 | 8k+ | Output is not escaped | ||
| #884 | Interactive Image Map Plugin – Draw Attention | 29 | 620 | 227 | 20k+ | Output is not escaped | ||
| #885 | ECPay Ecommerce for WooCommerce | 29 | 248 | 370 | 2k+ | Missing nonce verification | ||
| #886 | Gianism | 29 | 391 | 154 | 700 | Text Domain Mismatch | ||
| #887 | Jetpack Boost – Website Speed, Performance and Critical CSS | 29 | 659 | 247 | 200k+ | Text Domain Mismatch | ||
| #888 | Laposta WooCommerce | 29 | 96 | 115 | 500 | Non-prefixed global variable | ||
| #889 | Meow Gallery | 29 | 113 | 182 | 10k+ | Direct Query | ||
| #890 | Music Player for WooCommerce | 29 | 107 | 155 | 1k+ | Non-prefixed global variable | ||
| #891 | Page View Count | 29 | 106 | 246 | 10k+ | Dynamic hook name | ||
| #892 | pCloud WP Backup | 29 | 120 | 73 | 1k+ | Exception output is not escaped | ||
| #893 | PhastPress | 29 | 95 | 52 | 10k+ | Exception output is not escaped | ||
| #894 | PlatiOnline Payments | 29 | 304 | 110 | 700 | Output is not escaped | ||
| #895 | Post Views Counter | 29 | 179 | 398 | 200k+ | Non-prefixed hook name | ||
| #896 | Pósturinn\'s Shipping with WooCommerce | 29 | 713 | 551 | 500 | Text Domain Mismatch | ||
| #897 | Responder | 29 | 77 | 185 | 3k+ | Non-prefixed global variable | ||
| #898 | SamedayCourier Shipping | 29 | 336 | 269 | 4k+ | Non Singular String Literal Domain | ||
| #899 | Social Engine | 29 | 133 | 90 | 600 | Exception output is not escaped | ||
| #900 | SQLite Database Integration | 29 | 161 | 89 | 3k+ | Exception output is not escaped |
