WordPress.Security.EscapeOutput.ExceptionNotEscaped
Exception output is not escaped
An exception message or related exception value is printed without escaping.
Why It Shows Up
The scan found exception data being displayed directly in HTML output.
Why It Matters
Exception messages can include file paths, request values, remote API responses, or database details. Printing them raw can expose information or create XSS risk.
How to Fix
- Use `esc_html()` or another context-appropriate escaping function before displaying exception text.
- Show a generic user-facing message and log the detailed exception for administrators or developers.
- Do not print stack traces, paths, or raw remote responses on public pages.
References
Affected Plugins
| Rank | Plugin | Score | Errors | Warnings | Installs | Added | Updated | Top Issue |
|---|---|---|---|---|---|---|---|---|
| #151 | IMPress for IDX Broker | 22 | 1,085 | 636 | 6k+ | Text Domain Mismatch | ||
| #152 | Insert or Embed Articulate Content into WordPress | 22 | 659 | 1,437 | 2k+ | Non-prefixed global variable | ||
| #153 | Számlázz.hu integráció WooCommerce-hez | 22 | 1,169 | 460 | 7k+ | Text Domain Mismatch | ||
| #154 | The Innovative Form Builder – IvyForms | 22 | 713 | 250 | 500 | Exception output is not escaped | ||
| #155 | InfiniteWP Client | 22 | 2,286 | 1,812 | 200k+ | Exception output is not escaped | ||
| #156 | Import WP – Export and Import CSV and XML files to WordPress | 22 | 580 | 330 | 4k+ | Exception output is not escaped | ||
| #157 | JCC Payment Gateway for Woocommerce | 22 | 2,273 | 1,136 | 600 | Text Domain Mismatch | ||
| #158 | JCH Optimize | 22 | 1,143 | 136 | 4k+ | Output is not escaped | ||
| #159 | Jetpack – WP Security, Backup, Speed, & Growth | 22 | 2,975 | 1,348 | 3m+ | Text Domain Mismatch | ||
| #160 | Jim Soft Swiss QR Invoice | 22 | 262 | 392 | 400 | Non-prefixed global variable | ||
| #161 | LearnPress – WordPress LMS Plugin for Create and Sell Online Courses | 22 | 2,346 | 3,341 | 70k+ | Non-prefixed global variable | ||
| #162 | Custom Login Page Customizer – Login Designer | 22 | 588 | 1,455 | 30k+ | Non-prefixed global variable | ||
| #163 | Mail Baby SMTP | 22 | 385 | 699 | 600 | SQL query is not prepared | ||
| #164 | MailOptin – Popup, Optin Forms & Email Newsletters for Mailchimp, HubSpot, AWeber Etc. | 22 | 2,625 | 2,458 | 10k+ | Output is not escaped | ||
| #165 | MarketKing — Ultimate WooCommerce Multivendor Marketplace Solution | 22 | 1,131 | 1,844 | 800 | Non-prefixed global variable | ||
| #166 | Slider, Gallery, and Carousel by MetaSlider – Image Slider, Video Slider | 22 | 207 | 323 | 500k+ | Non-prefixed global variable | ||
| #167 | Modula Image Gallery – Photo Grid & Video Gallery | 22 | 474 | 436 | 100k+ | Text Domain Mismatch | ||
| #168 | Newsletters | 22 | 2,968 | 2,248 | 2k+ | Text Domain Mismatch | ||
| #169 | WP OAuth Server (OAuth Authentication) | 22 | 189 | 347 | 3k+ | Non-prefixed function | ||
| #170 | Packeta | 22 | 801 | 333 | 8k+ | Exception output is not escaped | ||
| #171 | Packlink PRO for WooCommerce | 22 | 468 | 160 | 20k+ | badly named files | ||
| #172 | PagBank / PagSeguro Connect para WooCommerce | 22 | 504 | 757 | 4k+ | Non-prefixed global variable | ||
| #173 | PDF Builder for WPForms | 22 | 321 | 266 | 900 | SQL query is not prepared | ||
| #174 | Smart Popup by Supsystic | 22 | 3,172 | 503 | 10k+ | Non Singular String Literal Domain | ||
| #175 | Post SMTP – Complete Email Deliverability and SMTP Solution with Email Logs, Alerts, Backup SMTP & Mobile App | 22 | 1,581 | 2,326 | 300k+ | Non-prefixed global variable | ||
| #176 | Premium Addons for Elementor – Powerful Elementor Templates & Widgets | 22 | 223 | 1,036 | 700k+ | Non-prefixed hook name | ||
| #177 | Prime Mover – Migrate WordPress Website & Backups | 22 | 1,326 | 1,600 | 10k+ | Non-prefixed global variable | ||
| #178 | Product Catalog Feed by PixelYourSite | 22 | 581 | 357 | 8k+ | Output is not escaped | ||
| #179 | Pronamic Pay | 22 | 258 | 1,077 | 2k+ | Non-prefixed global variable | ||
| #180 | PageSpeed Ninja – Cache, Minify, Defer CSS JavaScript, Critical CSS, Optimize Images, Convert WebP | 22 | 984 | 407 | 5k+ | Unsafe printing function | ||
| #181 | Quick Contact Form | 22 | 260 | 623 | 1k+ | Non-prefixed function | ||
| #182 | RabbitLoader Cache: Optimize your Website for Speed | 22 | 241 | 163 | 2k+ | Output is not escaped | ||
| #183 | Restrict User Access – Ultimate Membership & Content Protection | 22 | 977 | 1,840 | 10k+ | Non-prefixed global variable | ||
| #184 | Seraphinite Accelerator | 22 | 594 | 255 | 50k+ | Output is not escaped | ||
| #185 | Slick Popup: Contact Form 7 Popup Plugin | 22 | 2,322 | 316 | 2k+ | Text Domain Mismatch | ||
| #186 | Slim Jetpack | 22 | 2,586 | 1,947 | 2k+ | Text Domain Mismatch | ||
| #187 | SNS Count Cache | 22 | 918 | 120 | 8k+ | Non Singular String Literal Domain | ||
| #188 | NextScripts: Social Networks Auto-Poster | 22 | 2,408 | 1,133 | 30k+ | Output is not escaped | ||
| #189 | SportsPress – Sports Club & League Manager | 22 | 460 | 2,246 | 10k+ | Non-prefixed global variable | ||
| #190 | SSL Zen — SSL Certificate Installer & HTTPS Redirects | 22 | 751 | 1,605 | 10k+ | Non-prefixed global variable | ||
| #191 | SVG Flags – Beautiful Scalable Flags For All Countries! | 22 | 755 | 1,251 | 2k+ | Non-prefixed global variable | ||
| #192 | Swift Performance Lite | 22 | 2,346 | 1,325 | 7k+ | Text Domain Mismatch | ||
| #193 | Theme Editor | 22 | 798 | 685 | 50k+ | Output is not escaped | ||
| #194 | Customize Feeds for Twitter | 22 | 92 | 171 | 4k+ | Non-prefixed global variable | ||
| #195 | Ultimate Carousel For Divi | 22 | 590 | 1,566 | 800 | Non-prefixed global variable | ||
| #196 | Ultimeter | 22 | 751 | 1,344 | 1k+ | Non-prefixed global variable | ||
| #197 | Uncanny Automator – Easy Automation, Integration, Webhooks & Workflow Builder Plugin | 22 | 532 | 2,367 | 40k+ | Direct Query | ||
| #198 | Uncanny Toolkit for LearnDash | 22 | 539 | 994 | 20k+ | Output is not escaped | ||
| #199 | Unlimited Elements Blocks Library | 22 | 708 | 1,822 | 400 | Non-prefixed global variable | ||
| #200 | RapidLoad AI – Optimize Web Vitals Automatically | 22 | 81 | 840 | 700 | Nonce verification recommended |
