PluginScore

WordPress.Security.EscapeOutput.ExceptionNotEscaped

Exception output is not escaped

An exception message or related exception value is printed without escaping.

critical weight

Why It Shows Up

The scan found exception data being displayed directly in HTML output.

Why It Matters

Exception messages can include file paths, request values, remote API responses, or database details. Printing them raw can expose information or create XSS risk.

How to Fix

  • Use `esc_html()` or another context-appropriate escaping function before displaying exception text.
  • Show a generic user-facing message and log the detailed exception for administrators or developers.
  • Do not print stack traces, paths, or raw remote responses on public pages.

References

WordPress escaping functions

Affected Plugins

RankPluginScoreErrorsWarningsInstallsAddedUpdatedTop Issue
#1501QRCode652139400Non-prefixed constant
#1502Royal MCP – Secure AI Connector for Claude, ChatGPT & Gemini656338k+Interpolated SQL is not prepared
#1503USPS Simple Shipping for Woocommerce6520118k+Exception output is not escaped
#1504Ajaxify Comments – Ajax and Lazy Loading Comments6520383k+Non-prefixed hook name
#1505Password Reset with Code for WordPress REST API66248900Exception output is not escaped
#1506Easy PHP Settings6634481k+Missing Translators Comment
#1507Icon Widget661494k+Output is not escaped
#1508Ajax add to cart for WooCommerce66673110k+Text Domain Mismatch
#1509Flexible Product Fields (WooCommerce Product Addons) – WooCommerce Product Page Editor67579810k+Non-prefixed global variable
#1510WordPress.com Editing Toolkit6752901k+Missing direct file access protection
#1511wp-Typography67913320k+Missing direct file access protection
#1512Product Category Slider for WooCommerce6821104800Non-prefixed hook name
#1513Solid Mail – SMTP email and logging made by SolidWP68161760k+Database parameter is not escaped
#1514WP Wand – Unlimited Content Generation using AI – for OpenAI, Claude, Openrouter and Deepseek69452251k+Text Domain Mismatch
#1515Zapper Payments691111600Output is not escaped
#1516In-feed ads for Google AdSense7020206k+Non-prefixed global variable
#1517Shipping Notices and No shipping options found info for WooCommerce70918400Non-prefixed global variable
#1518Stitch Express70106400Output is not escaped
#1519Block Emails & Addresses for WooCommerce Checkout70412700error log set error handler
#1520commonWP711833400Non-prefixed hook name
#1521SmartSMTP718422k+Nonce verification recommended
#1522WindPress – Tailwind CSS integration for WordPress71161063k+Non-prefixed hook name
#1523WPGraphQL Smart Cache718797k+Text Domain Mismatch
#1524Starter Templates & Sites Pack by ThemeGrill72285170k+Non-prefixed hook name
#1525Ultimate Member Custom Tab Builder Lite721215500Output is not escaped
#1526Direct Checkout for WooCommerce72773580k+Text Domain Mismatch
#1527Email Test – Check if your emails are being delivered73871k+Exception output is not escaped
#1528Export Media Library735530k+Output is not escaped
#1529Comment Edit Core – Simple Comment Editing7327852k+Non-prefixed hook name
#1530CoinGate for WooCommerce743518400Text Domain Mismatch
#1531Highlight and Share – Unobtrusive and Lightweight Content Sharing7412115800Non-prefixed hook name
#1532Change Storefront Footer Copyright Text7471214k+Text Domain Mismatch
#1533Conditional Logic Emails, Fields, Redirect for Elementor Forms75312312k+wp function not compatible with requires wp
#1534Styled Calendar – Customizable, Mobile Responsive Google Calendar Embeds75881k+Exception output is not escaped
#1535AI Provider for OpenAI7615130k+Exception output is not escaped
#1536Autocomplete WooCommerce Orders76705530k+Text Domain Mismatch
#1537FormGent – Next-Gen AI Form Builder for WordPress with Multi-Step, Quizzes, Payments & More76173331k+Non-prefixed global variable
#1538Payment Gateway for Authorize.net for WooCommerce76616700Input is not sanitized
#1539Ultimate Data Table Addon For Elementor76801k+Exception output is not escaped
#1540Lead Generation Contact Widget & AI Chatbot: Chat Button, Phone Call, Telegram, Email – SiteLeads7717110k+Exception output is not escaped
#1541X-Currency – The Ultimate WooCommerce currency switcher for a smoother shopping experience7717771k+Non-prefixed global variable
#1542AI Provider for Anthropic7813130k+Exception output is not escaped
#1543Web3 Crypto Payments by DePay for WooCommerce7861011k+Direct Query
#1544Fygaro WC Plugin79386600Text Domain Mismatch
#1545Flutterwave Payments79839600Non-prefixed global variable
#1546Remove noreferrer7917145k+Missing Arg Domain
#1547SureMail – SMTP and Email Logs Plugin with Amazon SES, Postmark, and Other Providers794566200k+Non-prefixed hook name
#1548Falang for Elementor Lite8081400Exception output is not escaped
#1549Flexible Wishlist for WooCommerce – Ecommerce Wishlist & Save for later802125800Non-prefixed global variable
#1550Fluent PDF Generator80102620k+Text Domain Mismatch