Exception output is not escaped

Why It Shows Up

The scan found exception data being displayed directly in HTML output.

Why It Matters

Exception messages can include file paths, request values, remote API responses, or database details. Printing them raw can expose information or create XSS risk.

How to Fix

• Use `esc_html()` or another context-appropriate escaping function before displaying exception text.
• Show a generic user-facing message and log the detailed exception for administrators or developers.
• Do not print stack traces, paths, or raw remote responses on public pages.

References