WordPress.Security.EscapeOutput.ExceptionNotEscaped
Exception output is not escaped
An exception message or related exception value is printed without escaping.
Why It Shows Up
The scan found exception data being displayed directly in HTML output.
Why It Matters
Exception messages can include file paths, request values, remote API responses, or database details. Printing them raw can expose information or create XSS risk.
How to Fix
- Use `esc_html()` or another context-appropriate escaping function before displaying exception text.
- Show a generic user-facing message and log the detailed exception for administrators or developers.
- Do not print stack traces, paths, or raw remote responses on public pages.
References
Affected Plugins
| Rank | Plugin | Score | Errors | Warnings | Installs | Added | Updated | Top Issue |
|---|---|---|---|---|---|---|---|---|
| #901 | SureForms – Drag & Drop Contact Form & Form Builder, Payment Form, Survey, Quiz & Calculator | 29 | 336 | 198 | 500k+ | Text Domain Mismatch | ||
| #902 | SureMembers – Membership & Content Restriction Plugin | 29 | 359 | 248 | 1k+ | Text Domain Mismatch | ||
| #903 | Wenprise Alipay Gateway For WooCommerce | 29 | 113 | 68 | 700 | Exception output is not escaped | ||
| #904 | Sofortueberweisung Gateway for Woocommerce | 29 | 104 | 71 | 700 | Output is not escaped | ||
| #905 | WP Subscribe | 29 | 79 | 79 | 7k+ | Non-prefixed class | ||
| #906 | WPComplete | 29 | 383 | 333 | 1k+ | Output is not escaped | ||
| #907 | AI Product Tools – Bulk Product Content Generator & AI Toolkit for WooCommerce | 30 | 508 | 562 | 400 | SQL query is not prepared | ||
| #908 | Contact Form 7 Connector | 30 | 324 | 196 | 5k+ | Text Domain Mismatch | ||
| #909 | Colete-Online | 30 | 776 | 346 | 600 | Text Domain Mismatch | ||
| #910 | Cryptocurrency Donation Box – Bitcoin & Crypto Donations | 30 | 334 | 284 | 500 | Output is not escaped | ||
| #911 | EDI – Обмен данными между WooCommerce и 1С | 30 | 284 | 101 | 600 | Text Domain Mismatch | ||
| #912 | Eway Payment Gateway | 30 | 509 | 92 | 800 | Missing Translators Comment | ||
| #913 | Formzu WP | 30 | 167 | 163 | 3k+ | Text Domain Mismatch | ||
| #914 | Kargo Takip, Kargo SMS, İlçe Mahalle Sözleşme by Hezarfen | 30 | 70 | 297 | 2k+ | Non-prefixed global variable | ||
| #915 | Invisible reCaptcha for WordPress | 30 | 90 | 185 | 80k+ | Input is not sanitized | ||
| #916 | Jetpack Protect | 30 | 657 | 217 | 100k+ | Text Domain Mismatch | ||
| #917 | core plugin for kitestudio themes | 30 | 244 | 415 | 500 | Nonce verification recommended | ||
| #918 | Laposta Signup Embed | 30 | 88 | 19 | 1k+ | Exception output is not escaped | ||
| #919 | Mailrelay | 30 | 318 | 170 | 1k+ | Text Domain Mismatch | ||
| #920 | Midtrans-WooCommerce | 30 | 112 | 132 | 5k+ | Non-prefixed global variable | ||
| #921 | Novelist | 30 | 475 | 158 | 1k+ | Output is not escaped | ||
| #922 | گرویتی فرم فارسی | 30 | 205 | 157 | 20k+ | Text Domain Mismatch | ||
| #923 | Rublon Multi-Factor Authentication (MFA) | 30 | 216 | 160 | 400 | Output is not escaped | ||
| #924 | Sina Extension for Elementor | 30 | 3,691 | 160 | 40k+ | Text Domain Mismatch | ||
| #925 | SMTP for Amazon SES – YaySMTP | 30 | 197 | 122 | 3k+ | Exception output is not escaped | ||
| #926 | Travelers' Map | 30 | 311 | 155 | 1k+ | Output is not escaped | ||
| #927 | Urvanov Syntax Highlighter | 30 | 221 | 87 | 3k+ | Output is not escaped | ||
| #928 | User Access Manager | 30 | 393 | 171 | 10k+ | Output is not escaped | ||
| #929 | Webling | 30 | 147 | 313 | 500 | Input is not validated | ||
| #930 | Widgetize Pages Light | 30 | 145 | 104 | 3k+ | Output is not escaped | ||
| #931 | Delivery & Pickup Date Time for WooCommerce | 30 | 439 | 435 | 5k+ | Non-prefixed global variable | ||
| #932 | WooCommerce Stripe Payment Gateway | 30 | 173 | 591 | 700k+ | Non-prefixed hook name | ||
| #933 | WooPayments: Integrated WooCommerce Payments | 30 | 182 | 308 | 900k+ | Exception output is not escaped | ||
| #934 | WooCommerce Tax (formerly WooCommerce Shipping & Tax) | 30 | 103 | 198 | 600k+ | Non-prefixed class | ||
| #935 | WP Event Aggregator: Import Eventbrite events, Meetup events, social events and any iCal Events into Event Calendar | 30 | 113 | 419 | 1k+ | Non-prefixed global variable | ||
| #936 | remarketable | 30 | 281 | 93 | 600 | Output is not escaped | ||
| #937 | WP Mail SMTP by WPForms – The Most Popular SMTP and Email Log Plugin | 30 | 32 | 346 | 4m+ | Non-prefixed hook name | ||
| #938 | Yaad Sarig Payment Gateway For WC | 30 | 158 | 271 | 2k+ | Nonce verification recommended | ||
| #939 | YayPricing – WooCommerce Dynamic Pricing & Discounts | 30 | 174 | 186 | 3k+ | Non-prefixed global variable | ||
| #940 | YITH Pre-Order for WooCommerce | 30 | 397 | 1,464 | 6k+ | Non-prefixed global variable | ||
| #941 | YITH WooCommerce Popup | 30 | 395 | 1,551 | 2k+ | Non-prefixed global variable | ||
| #942 | YITH WooCommerce Product Slider Carousel | 30 | 389 | 1,479 | 4k+ | Non-prefixed global variable | ||
| #943 | zahls.ch Credit Cards, PostFinance and TWINT for WooCommerce | 30 | 121 | 265 | 3k+ | Non-prefixed global variable | ||
| #944 | a3 Lazy Load | 31 | 83 | 239 | 90k+ | Dynamic hook name | ||
| #945 | AEH Speed Optimization: Browser Cache, Optimized Minify, Lazy Loading & Image Optimization | 31 | 91 | 133 | 2k+ | Output is not escaped | ||
| #946 | Extra Product Options Builder for WooCommerce | 31 | 113 | 194 | 2k+ | Non-prefixed global variable | ||
| #947 | Titan Anti-spam & Security – Brute Force Protection, 2FA & Spam Filter | 31 | 57 | 196 | 50k+ | Nonce verification recommended | ||
| #948 | Apaczka.pl WooCommerce | 31 | 99 | 276 | 1k+ | Non-prefixed global variable | ||
| #949 | APCu Manager | 31 | 153 | 136 | 10k+ | Output is not escaped | ||
| #950 | Thanh Toán Quét Mã QR Code Tự Động – MoMo, ViettelPay, VNPay và 40 ngân hàng Việt Nam | 31 | 598 | 70 | 700 | Text Domain Mismatch |
