WordPress.Security.EscapeOutput.ExceptionNotEscaped
Exception output is not escaped
An exception message or related exception value is printed without escaping.
Why It Shows Up
The scan found exception data being displayed directly in HTML output.
Why It Matters
Exception messages can include file paths, request values, remote API responses, or database details. Printing them raw can expose information or create XSS risk.
How to Fix
- Use `esc_html()` or another context-appropriate escaping function before displaying exception text.
- Show a generic user-facing message and log the detailed exception for administrators or developers.
- Do not print stack traces, paths, or raw remote responses on public pages.
References
Affected Plugins
| Rank | Plugin | Score | Errors | Warnings | Installs | Added | Updated | Top Issue |
|---|---|---|---|---|---|---|---|---|
| #1251 | Zeno – AI-Powered Chatbot | 36 | 311 | 131 | 400 | Text Domain Mismatch | ||
| #1252 | Adapta RGPD | 37 | 349 | 72 | 40k+ | Text Domain Mismatch | ||
| #1253 | Antom Payments | 37 | 62 | 73 | 800 | badly named files | ||
| #1254 | Asesor de Cookies RGPD para normativa europea | 37 | 92 | 87 | 20k+ | wp function not compatible with requires wp | ||
| #1255 | authLdap | 37 | 46 | 30 | 4k+ | Exception output is not escaped | ||
| #1256 | Avatar Privacy | 37 | 82 | 36 | 1k+ | Missing direct file access protection | ||
| #1257 | Blimply | 37 | 172 | 43 | 800 | Text Domain Mismatch | ||
| #1258 | bunny.net – WordPress CDN Plugin | 37 | 165 | 159 | 10k+ | Output is not escaped | ||
| #1259 | Call Now Button – The #1 Click to Call Button for WordPress | 37 | 1,273 | 5 | 200k+ | Exception output is not escaped | ||
| #1260 | Clearpay Gateway for WooCommerce | 37 | 185 | 63 | 1k+ | Text Domain Mismatch | ||
| #1261 | Constant Contact Forms by MailMunch | 37 | 147 | 53 | 2k+ | wp function not compatible with requires wp | ||
| #1262 | CorvusPay WooCommerce Payment Gateway | 37 | 29 | 141 | 1k+ | Missing nonce verification | ||
| #1263 | Debug Log Viewer | 37 | 26 | 83 | 1k+ | Missing nonce verification | ||
| #1264 | Easy Photo Album | 37 | 360 | 43 | 1k+ | Text Domain Mismatch | ||
| #1265 | EasyMe Connect | 37 | 130 | 45 | 500 | Text Domain Mismatch | ||
| #1266 | Furgonetka.pl: Przesyłki & Narzędzia e-commerce | 37 | 66 | 48 | 7k+ | Exception output is not escaped | ||
| #1267 | Gmail SMTP | 37 | 85 | 71 | 10k+ | Unsafe printing function | ||
| #1268 | Google for WooCommerce | 37 | 328 | 121 | 800k+ | Exception output is not escaped | ||
| #1269 | LiveAgent – Omnichannel Help Desk & Live Chat Software | 37 | 125 | 142 | 400 | Non Singular String Literal Domain | ||
| #1270 | MailingBoss WP Plugin | 37 | 108 | 30 | 600 | Output is not escaped | ||
| #1271 | Media Sweep – WordPress Media Cleaner | 37 | 56 | 137 | 1k+ | Interpolated SQL is not prepared | ||
| #1272 | WP All Export – Order Export for WooCommerce | 37 | 109 | 111 | 3k+ | Text Domain Mismatch | ||
| #1273 | Robots & Sitemap | 37 | 199 | 28 | 500 | Text Domain Mismatch | ||
| #1274 | Sensei LMS Certificates | 37 | 97 | 362 | 4k+ | Non-prefixed global variable | ||
| #1275 | Sezzle Woocommerce Payment | 37 | 108 | 105 | 1k+ | Text Domain Mismatch | ||
| #1276 | Smart Send Logistics | 37 | 92 | 81 | 400 | Output is not escaped | ||
| #1277 | Social Comments | 37 | 59 | 32 | 400 | Output is not escaped | ||
| #1278 | Tracking Code Manager | 37 | 55 | 42 | 90k+ | Output is not escaped | ||
| #1279 | Ultimate Tag Cloud Widget | 37 | 715 | 16 | 4k+ | Output is not escaped | ||
| #1280 | ViaBill – WooCommerce | 37 | 437 | 86 | 500 | Text Domain Mismatch | ||
| #1281 | Amazon Pay for WooCommerce | 37 | 29 | 117 | 10k+ | Non-prefixed class | ||
| #1282 | WooCommerce PayPal Payments | 37 | 194 | 110 | 800k+ | Exception output is not escaped | ||
| #1283 | Quickpay for WooCommerce | 37 | 66 | 56 | 4k+ | Nonce verification recommended | ||
| #1284 | Wordable – Export Google Docs to WordPress | 37 | 47 | 63 | 2k+ | Output is not escaped | ||
| #1285 | Hustle – Email Marketing, Lead Generation, Optins, Popups | 37 | 4,894 | 5,942 | 90k+ | Non-prefixed global variable | ||
| #1286 | Fix Media Library | 37 | 53 | 71 | 1k+ | Output is not escaped | ||
| #1287 | WPForce Logout – WordPress User Login Logout Management Plugin | 37 | 567 | 32 | 8k+ | Output is not escaped | ||
| #1288 | FundEngine – Donation and Crowdfunding Platform | 37 | 89 | 9 | 1k+ | Exception output is not escaped | ||
| #1289 | WP Plugin Info Card | 37 | 53 | 376 | 500 | Nonce verification recommended | ||
| #1290 | TopNewsWp – Display Tikcer News, RSS Feed Widget and Many More | 37 | 878 | 59 | 800 | Output is not escaped | ||
| #1291 | Zakeke Interactive Product Designer for WooCommerce | 37 | 186 | 177 | 2k+ | Nonce verification recommended | ||
| #1292 | Action Scheduler | 38 | 92 | 134 | 20k+ | Exception output is not escaped | ||
| #1293 | AWCA – The Great Analytics Insights for Your eStore | 38 | 238 | 143 | 2k+ | Output is not escaped | ||
| #1294 | Advanced Media Offloader | 38 | 57 | 93 | 5k+ | error log error log | ||
| #1295 | Afterpay Gateway for WooCommerce | 38 | 183 | 62 | 10k+ | Text Domain Mismatch | ||
| #1296 | Aplazame | 38 | 34 | 39 | 600 | Non-prefixed global variable | ||
| #1297 | Bulgarisation for WooCommerce | 38 | 129 | 592 | 5k+ | Nonce verification recommended | ||
| #1298 | Cache Warmer | 38 | 32 | 219 | 1k+ | Interpolated SQL is not prepared | ||
| #1299 | Cecabank WooCommerce Plugin | 38 | 63 | 32 | 3k+ | Text Domain Mismatch | ||
| #1300 | CF7 to Webhook | 38 | 102 | 72 | 30k+ | Unsafe printing function |
