PluginScore

WordPress.Security.EscapeOutput.ExceptionNotEscaped

Exception output is not escaped

An exception message or related exception value is printed without escaping.

critical weight

Why It Shows Up

The scan found exception data being displayed directly in HTML output.

Why It Matters

Exception messages can include file paths, request values, remote API responses, or database details. Printing them raw can expose information or create XSS risk.

How to Fix

  • Use `esc_html()` or another context-appropriate escaping function before displaying exception text.
  • Show a generic user-facing message and log the detailed exception for administrators or developers.
  • Do not print stack traces, paths, or raw remote responses on public pages.

References

WordPress escaping functions

Affected Plugins

RankPluginScoreErrorsWarningsInstallsAddedUpdatedTop Issue
#101Revive Social – Social Media Auto Post and Scheduling Automation Plugin2125542520k+Non-prefixed hook name
#102UPC/EAN/GTIN Barcode Generator/Importer21776311500Exception output is not escaped
#103Buckaroo Woocommerce Payments Plugin215843262k+Exception output is not escaped
#104BuddyPress WooCommerce My Account Integration. Create WooCommerce Member Pages216681,569900Non-prefixed global variable
#105WebP Express21160427300k+Non-prefixed global variable
#106Wise Chat214705065k+Output is not escaped
#107Paysera Payment Gateway for WooCommerce211,8661957k+Exception output is not escaped
#108Booster for WooCommerce – PDF Invoices, Abandoned Cart, Variation Swatches & 100+ Tools217863,39530k+Non-prefixed global variable
#109Pay For Post with WooCommerce219601,4741k+Non-prefixed global variable
#110Wordfence Security – Firewall, Malware Scan, and Login Security211,5922,9735m+Output is not escaped
#111WP-Lister Lite for eBay216,6975,1292k+Output is not escaped
#112WP phpMyAdmin214,5286,43550k+Missing Arg Domain
#113wpDataTables – WordPress Data Table, Dynamic Tables & Table Charts Plugin211,8111,43270k+Output is not escaped
#114WP Extended – The Ultimate WordPress Toolkit211,253398600Non Singular String Literal Domain
#115WPScan – WordPress Security Scanner215272658k+Text Domain Mismatch
#116WebTotem Security211,110213900Text Domain Mismatch
#117Frontend Admin by DynamiApps225,9223,20810k+Text Domain Mismatch
#118WP Sessions Time Monitoring Full Automatic228691,529500Non-prefixed global variable
#119Advanced Classifieds & Directory Pro221,2293,5112k+Non-prefixed global variable
#120Advanced Form Integration — Connect Forms to 200+ Apps225,7714,67810k+wp function not compatible with requires wp
#121All-in-One Video Gallery229112,89220k+Non-prefixed global variable
#122Booking for Appointments and Events Calendar – Amelia221,48948090k+Exception output is not escaped
#123Backup Bolt225801,313800Non-prefixed global variable
#124Knowledge Base documentation & wiki plugin – BasePress Docs226711,7672k+Non-prefixed global variable
#125Better Messages – Chat Rooms, Group Chat, Private Messages & AI Chat Bots221,6072,02210k+Direct Query
#126Better WordPress Minify224124848k+Non Singular String Literal Domain
#127Cleanup Action Scheduler225451,3061k+Non-prefixed global variable
#128Clearfy Cache – WordPress optimization plugin, Minify HTML, CSS & JS, Defer222,8581,27050k+Text Domain Mismatch
#129Accept PayPal Payments using Contact Form 722359127600Text Domain Mismatch
#130Passster – Password Protect Pages and Content225391,41910k+Non-prefixed global variable
#131Cozy Blocks – Page Builder for Gutenberg Editor & FSE with 500+ Patterns, 57 Blocks & Templates222,1674,1757k+Non-prefixed global variable
#132RegistrationMagic – Custom Registration Forms, User Registration, Payment, and User Login223,6545,0618k+Non-prefixed global variable
#133Data Tables Generator by Supsystic2215815210k+Exception output is not escaped
#134Directorist: AI-Powered Business Directory, Listings & Classified Ads225482,17220k+Non-prefixed global variable
#135Dynamic QR Code – generator222382086k+Missing direct file access protection
#136E2Pdf – Export Pdf Tool for WordPress221,07583610k+Unsafe printing function
#137Easy Social Feed – Social Photos Gallery and Post Feed for WordPress221,5671,27730k+Non-prefixed global variable
#138easyReservations225,3072,480800Text Domain Mismatch
#139EleSpare – News, Magazine and Blog Addons for Elementor227331,42310k+Non-prefixed global variable
#140Estatik Real Estate Plugin223,04932510k+Text Domain Mismatch
#141Events Manager – Calendar, Bookings, Tickets, and more!224,7135,66070k+Output is not escaped
#142File Manager Pro – Filester22565391100k+Request data is not unslashed
#143Finale Lite – Sales Countdown Timer & Discount for WooCommerce221,0314514k+Output is not escaped
#144FireBox Popups – Increase Sales and Grow Your Email List221538127k+Non-prefixed global variable
#145Fluent Forms – Customizable Contact Forms, Survey, Quiz, & Conversational Form Builder22409236700k+Text Domain Mismatch
#146Notification Bar, Announcement and Cookie Notice WordPress Plugin – FooBar221,3211,3713k+Non-prefixed global variable
#147Five Star Restaurant Menu and Food Ordering227526095k+Output is not escaped
#148FunnelKit Payment Gateway for Stripe WooCommerce2224432120k+Input is not sanitized
#149GeoDirectory – WP Business Directory Plugin and Classified Listings Directory224,4663,97210k+Output is not escaped
#150Happyforms – Form Builder for WordPress: Drag & Drop Contact Forms, Surveys, Payments & Multipurpose Forms221,03772220k+Unsafe printing function