WordPress.Security.EscapeOutput.ExceptionNotEscaped
Exception output is not escaped
An exception message or related exception value is printed without escaping.
Why It Shows Up
The scan found exception data being displayed directly in HTML output.
Why It Matters
Exception messages can include file paths, request values, remote API responses, or database details. Printing them raw can expose information or create XSS risk.
How to Fix
- Use `esc_html()` or another context-appropriate escaping function before displaying exception text.
- Show a generic user-facing message and log the detailed exception for administrators or developers.
- Do not print stack traces, paths, or raw remote responses on public pages.
References
Affected Plugins
| Rank | Plugin | Score | Errors | Warnings | Installs | Added | Updated | Top Issue |
|---|---|---|---|---|---|---|---|---|
| #1451 | WP Console – WordPress PHP Console powered by PsySH | 53 | 34 | 48 | 20k+ | Exception output is not escaped | ||
| #1452 | CSV Importer | 54 | 24 | 11 | 3k+ | Missing direct file access protection | ||
| #1453 | Cyr-To-Lat | 54 | 16 | 48 | 300k+ | Dynamic hook name | ||
| #1454 | Disqus Comment System | 54 | 17 | 33 | 40k+ | Non-prefixed hook name | ||
| #1455 | AI Agent by SiteGround | 54 | 28 | 6 | 1m+ | Exception output is not escaped | ||
| #1456 | SimplyBook.me – Booking and reservations calendar | 54 | 31 | 13 | 30k+ | Exception output is not escaped | ||
| #1457 | SpeedSize Image & Video AI-Optimizer | 54 | 98 | 17 | 400 | Text Domain Mismatch | ||
| #1458 | WP Menu Icons | 54 | 68 | 52 | 20k+ | Text Domain Mismatch | ||
| #1459 | Advanced Custom Order Status for WooCommerce | 55 | 44 | 33 | 500 | Text Domain Mismatch | ||
| #1460 | AI Assistant for Elementor – Auto Content Writer, OpenAI, ChatGPT | 55 | 151 | 24 | 400 | Text Domain Mismatch | ||
| #1461 | Popup Maker – Boost Sales, Conversions, Optins, Subscribers with the Ultimate WP Popup Builder | 55 | 54 | 692 | 700k+ | Non-prefixed hook name | ||
| #1462 | Quick Bulk Post & Page Creator | 55 | 43 | 1 | 2k+ | Text Domain Mismatch | ||
| #1463 | Quick Bulk Term Taxonomy Creator | 55 | 37 | 2 | 400 | Text Domain Mismatch | ||
| #1464 | Themeflection Numbers – Number Counter and Animated Numbers | 55 | 224 | 73 | 3k+ | Text Domain Mismatch | ||
| #1465 | AI Copilot – ChatGPT Chatbot & AI Engine for Post Automation | 56 | 65 | 20 | 1k+ | Text Domain Mismatch | ||
| #1466 | FluentSnippets – High-Performance Code Snippets, Header & Footer Code, Custom CSS & PHP Code Manager | 56 | 31 | 27 | 50k+ | Nonce verification recommended | ||
| #1467 | Fluent Connect – Connect ThriveCart with your WordPress and FluentCRM | 56 | 37 | 54 | 600 | curl curl setopt | ||
| #1468 | Grids: Layout builder for WordPress | 56 | 24 | 27 | 2k+ | Missing direct file access protection | ||
| #1469 | WC Moneris Payment Gateway | 56 | 82 | 20 | 900 | Text Domain Mismatch | ||
| #1470 | Social Chat – Click To Chat App Button | 56 | 81 | 45 | 200k+ | Text Domain Mismatch | ||
| #1471 | Hide Admin Notices | 57 | 9 | 16 | 20k+ | Input is not sanitized | ||
| #1472 | Search Exclude | 57 | 73 | 40 | 50k+ | Text Domain Mismatch | ||
| #1473 | Team View | 57 | 32 | 19 | 900 | Output is not escaped | ||
| #1474 | Debloat – Remove Unused CSS, Optimize JS | 58 | 24 | 20 | 30k+ | Nonce verification recommended | ||
| #1475 | Quickcreator – AI Blog Writer | 58 | 14 | 18 | 500 | Exception output is not escaped | ||
| #1476 | Safety Exit | 58 | 52 | 26 | 1k+ | Text Domain Mismatch | ||
| #1477 | etracker analytics | 59 | 16 | 9 | 1k+ | Exception output is not escaped | ||
| #1478 | FluentCommunity – Ultra-Fast High-Performance Social Network, Community, LMS & Online Courses | 59 | 41 | 14 | 8k+ | Exception output is not escaped | ||
| #1479 | Pattern Wrangler – Manage Block Patterns and Pattern Categories | 59 | 14 | 73 | 400 | Non-prefixed global variable | ||
| #1480 | pensopay Payments v2 | 59 | 413 | 32 | 1k+ | Non Singular String Literal Domain | ||
| #1481 | Super Progressive Web Apps | 59 | 62 | 22 | 40k+ | wp function not compatible with requires wp | ||
| #1482 | WC Korkmaz Contract – Contracts for WooCommerce | 59 | 7 | 38 | 500 | Non-prefixed global variable | ||
| #1483 | WooReer | 59 | 44 | 4 | 1k+ | Exception output is not escaped | ||
| #1484 | Variation Swatches for WooCommerce | 59 | 11 | 64 | 300k+ | Non-prefixed global variable | ||
| #1485 | Disable Emails | 60 | 25 | 16 | 30k+ | Short PHP open tag found | ||
| #1486 | Just Responsive Images | 60 | 25 | 7 | 500 | Missing direct file access protection | ||
| #1487 | Material Design for WordPress | 60 | 51 | 207 | 800 | Non-prefixed global variable | ||
| #1488 | Responsive videos – Fitvids | 60 | 26 | 3 | 700 | Output is not escaped | ||
| #1489 | Academy LMS | 61 | 18 | 521 | 2k+ | Non-prefixed global variable | ||
| #1490 | GetPaid Stripe Payments | 61 | 206 | 44 | 2k+ | Text Domain Mismatch | ||
| #1491 | RSS Feed Retriever | 61 | 23 | 8 | 7k+ | wp function not compatible with requires wp | ||
| #1492 | payOS | 62 | 19 | 26 | 500 | Request data is not unslashed | ||
| #1493 | Satispay for WooCommerce | 62 | 19 | 12 | 7k+ | Exception output is not escaped | ||
| #1494 | Rating Widget: Post Rating, 5 Star Rating, Reviews, Thumbs Up & Down, Reaction | 63 | 177 | 27 | 400 | Missing direct file access protection | ||
| #1495 | DataFeedWatch Connector for WooCommerce | 64 | 16 | 112 | 600 | Non-prefixed hook name | ||
| #1496 | MultiSafepay plugin for WooCommerce | 64 | 13 | 35 | 2k+ | Missing nonce verification | ||
| #1497 | Werk aan de Muur | 64 | 48 | 20 | 900 | Non Singular String Literal Domain | ||
| #1498 | WP Search with Algolia | 64 | 27 | 16 | 7k+ | Missing direct file access protection | ||
| #1499 | AI Provider for Google | 65 | 32 | 1 | 30k+ | Exception output is not escaped | ||
| #1500 | Dojo for WooCommerce | 65 | 71 | 13 | 800 | Text Domain Mismatch |
