WordPress.Security.EscapeOutput.ExceptionNotEscaped
Exception output is not escaped
An exception message or related exception value is printed without escaping.
Why It Shows Up
The scan found exception data being displayed directly in HTML output.
Why It Matters
Exception messages can include file paths, request values, remote API responses, or database details. Printing them raw can expose information or create XSS risk.
How to Fix
- Use `esc_html()` or another context-appropriate escaping function before displaying exception text.
- Show a generic user-facing message and log the detailed exception for administrators or developers.
- Do not print stack traces, paths, or raw remote responses on public pages.
References
Affected Plugins
| Rank | Plugin | Score | Errors | Warnings | Installs | Added | Updated | Top Issue |
|---|---|---|---|---|---|---|---|---|
| #1551 | Parallax Image | 80 | 6 | 1 | 2k+ | Missing direct file access protection | ||
| #1552 | Wincher Rank Tracker | 80 | 8 | 6 | 3k+ | Output is not escaped | ||
| #1553 | Metricool – Social media and site statistics | 82 | 9 | 4 | 80k+ | Exception output is not escaped | ||
| #1554 | Wicked Block Conditions | 82 | 6 | 6 | 600 | Nonce verification recommended | ||
| #1555 | Upload SVG | 84 | 3 | 8 | 1k+ | Non-prefixed global variable | ||
| #1556 | WP Notification Center | 84 | 7 | 8 | 1k+ | Exception output is not escaped | ||
| #1557 | Pay with LINE Pay | 84 | 12 | 10 | 700 | Missing Translators Comment | ||
| #1558 | AntiSpam for Contact Form 7 | 86 | 14 | 8 | 10k+ | Text Domain Mismatch | ||
| #1559 | Text Typing – Block | 86 | 3 | 5 | 3k+ | Missing nonce verification | ||
| #1560 | WP Dashboard Messages | 87 | 9 | 11 | 400 | Text Domain Mismatch | ||
| #1561 | ACF Dropzone | 88 | 4 | 3 | 1k+ | Exception output is not escaped | ||
| #1562 | Responsive Slick Slider WordPress | 88 | 3 | 131 | 500 | Non-prefixed global variable | ||
| #1563 | Font Awesome | 89 | 21 | 3 | 400k+ | Missing direct file access protection | ||
| #1564 | Fr Multi Bank Transfer Payment Gateways for WooCommerce | 89 | 28 | 2 | 2k+ | Text Domain Mismatch | ||
| #1565 | AI Powered Marketing | 89 | 8 | 8 | 50k+ | Offloaded Content | ||
| #1566 | Flodesk for Elementor Pro | 90 | 3 | 0 | 800 | Exception output is not escaped | ||
| #1567 | Mobile Detect | 90 | 4 | 1 | 3k+ | Exception output is not escaped | ||
| #1568 | Block Permissions | 91 | 7 | 1 | 400 | Non Singular String Literal Domain | ||
| #1569 | LH Multipart Email | 91 | 4 | 5 | 600 | Non-prefixed hook name | ||
| #1570 | reBusted! | 91 | 7 | 3 | 6k+ | Missing direct file access protection | ||
| #1571 | Widgets for Social Photo Feed | 91 | 1 | 147 | 10k+ | Non-prefixed global variable | ||
| #1572 | Widgets for Social Post Feed | 91 | 1 | 146 | 400 | Non-prefixed global variable | ||
| #1573 | WP Mobile Detect | 91 | 4 | 6 | 5k+ | trademarked term | ||
| #1574 | WP Session Manager | 91 | 5 | 16 | 2k+ | Direct Query | ||
| #1575 | WP Mautic | 92 | 3 | 5 | 6k+ | trademarked term |
