WordPress.Security.EscapeOutput.ExceptionNotEscaped
Exception output is not escaped
An exception message or related exception value is printed without escaping.
Why It Shows Up
The scan found exception data being displayed directly in HTML output.
Why It Matters
Exception messages can include file paths, request values, remote API responses, or database details. Printing them raw can expose information or create XSS risk.
How to Fix
- Use `esc_html()` or another context-appropriate escaping function before displaying exception text.
- Show a generic user-facing message and log the detailed exception for administrators or developers.
- Do not print stack traces, paths, or raw remote responses on public pages.
References
Affected Plugins
| Rank | Plugin | Score | Errors | Warnings | Installs | Added | Updated | Top Issue |
|---|---|---|---|---|---|---|---|---|
| #201 | UserFeedback – Create Interactive Feedback Form, User Surveys, and Polls in Seconds | 22 | 444 | 243 | 200k+ | Text Domain Mismatch | ||
| #202 | Walker Core | 22 | 1,351 | 1,436 | 700 | Non-prefixed global variable | ||
| #203 | WCFM – Frontend Manager for WooCommerce | 22 | 4,754 | 5,054 | 20k+ | Non-prefixed global variable | ||
| #204 | WCFM Marketplace – Multivendor Marketplace for WooCommerce | 22 | 1,934 | 1,966 | 10k+ | Non-prefixed global variable | ||
| #205 | WCFM Membership – WooCommerce Memberships for Multivendor Marketplace | 22 | 559 | 675 | 10k+ | Non-prefixed global variable | ||
| #206 | Peach Payments Gateway | 22 | 334 | 143 | 1k+ | Non Singular String Literal Domain | ||
| #207 | Wenprise WeChatPay Payment Gateway For WooCommerce | 22 | 443 | 178 | 400 | Exception output is not escaped | ||
| #208 | Fraud Prevention For WooCommerce and EDD | 22 | 572 | 1,394 | 5k+ | Non-prefixed global variable | ||
| #209 | WooCommerce | 22 | 1,359 | 6,172 | 7m+ | Non-prefixed global variable | ||
| #210 | Simple Shopping Cart | 22 | 796 | 536 | 10k+ | Unsafe printing function | ||
| #211 | ManageWP Worker | 22 | 507 | 565 | 1m+ | Non-prefixed class | ||
| #212 | WP Affiliate Disclosure | 22 | 1,358 | 1,504 | 1k+ | Non-prefixed global variable | ||
| #213 | Asset CleanUp: Page Speed Booster | 22 | 2,030 | 2,485 | 100k+ | Non-prefixed global variable | ||
| #214 | Master Accordion ( Former WP Awesome FAQ Plugin ) | 22 | 1,774 | 1,286 | 700 | Non-prefixed global variable | ||
| #215 | WP Easy Pay – Payment and Donation form Builder for Square | 22 | 910 | 1,835 | 1k+ | Non-prefixed global variable | ||
| #216 | WP Express Checkout (Fast Payments via PayPal & Stripe) | 22 | 591 | 627 | 1k+ | Output is not escaped | ||
| #217 | File Manager | 22 | 740 | 520 | 1m+ | Unsafe printing function | ||
| #218 | WP Umbrella: Update Backup Restore & Monitoring | 22 | 921 | 919 | 70k+ | Exception output is not escaped | ||
| #219 | SchedulePress – Auto Post & Publish, Auto Social Share, Schedule Posts with Editorial Calendar & Missed Schedule Post Publisher | 22 | 307 | 245 | 10k+ | Output is not escaped | ||
| #220 | WP Super Minify • Minify, Compress and Cache HTML, CSS & JavaScript | 22 | 164 | 257 | 8k+ | Non-prefixed constant | ||
| #221 | NotifSMS – SMS Notifications OTP & 2FA for WordPress & WooCommerce | 22 | 1,353 | 1,412 | 2k+ | Non-prefixed global variable | ||
| #222 | User Frontend: AI Powered Frontend Posting, User Directory, Profile Builder, Membership & User Registration | 22 | 287 | 1,432 | 20k+ | Non-prefixed global variable | ||
| #223 | WP-WebAuthn | 22 | 957 | 396 | 2k+ | Exception output is not escaped | ||
| #224 | WPBITS Addons For Elementor Page Builder | 22 | 996 | 1,399 | 2k+ | Non-prefixed global variable | ||
| #225 | WPFunnels – Funnel Builder for WooCommerce with Checkout & One Click Upsell | 22 | 6,002 | 2,790 | 5k+ | Text Domain Mismatch | ||
| #226 | WUPO Group Attributes for WooCommerce | 22 | 592 | 1,391 | 400 | Non-prefixed global variable | ||
| #227 | YaySMTP – WP Mail SMTP with Email Logs, Tracking & Reports | 22 | 654 | 435 | 10k+ | Exception output is not escaped | ||
| #228 | YITH WooCommerce Ajax Search | 22 | 408 | 1,659 | 30k+ | Non-prefixed global variable | ||
| #229 | ЮKassa для WooCommerce | 22 | 590 | 168 | 9k+ | Short PHP open tag found | ||
| #230 | Recipe Cards For Your Food Blog from Zip Recipes | 22 | 1,126 | 1,731 | 1k+ | Non-prefixed global variable | ||
| #231 | Gutenberg Blocks – ACF Blocks Suite | 23 | 1,097 | 1,449 | 400 | Non-prefixed global variable | ||
| #232 | Frontend Admin by DynamiApps | 23 | 5,938 | 3,208 | 9k+ | Text Domain Mismatch | ||
| #233 | Custom WooCommerce Checkout Fields Editor | 23 | 755 | 1,386 | 2k+ | Non-prefixed global variable | ||
| #234 | Advanced Menu Manager Pro – Built for Content-heavy WordPress Sites to Add, Filter, Lock, and Edit Menus Easily | 23 | 545 | 1,397 | 400 | Non-prefixed global variable | ||
| #235 | Advanced Ads – Ad Manager & AdSense | 23 | 559 | 719 | 100k+ | Non-prefixed global variable | ||
| #236 | Advanced Form Integration — Connect Forms to 200+ Apps | 23 | 5,783 | 4,687 | 10k+ | wp function not compatible with requires wp | ||
| #237 | AI Engine – The Chatbot, AI Framework & MCP for WordPress | 23 | 408 | 539 | 100k+ | error log error log | ||
| #238 | Affiliate Super Assistent | 23 | 1,280 | 267 | 1k+ | Text Domain Mismatch | ||
| #239 | Fullscreen Menu | 23 | 537 | 1,287 | 2k+ | Non-prefixed global variable | ||
| #240 | Autocomplete Address and Location Picker for WooCommerce | 23 | 630 | 1,299 | 2k+ | Non-prefixed global variable | ||
| #241 | Autoptimize | 23 | 288 | 191 | 800k+ | Output is not escaped | ||
| #242 | Shortcodes and extra features for Phlox theme | 23 | 412 | 424 | 90k+ | Output is not escaped | ||
| #243 | BA Book Everything | 23 | 1,184 | 1,086 | 10k+ | Output is not escaped | ||
| #244 | Kadence Security – Password, Two Factor Authentication, and Brute Force Protection | 23 | 1,053 | 967 | 700k+ | Missing Translators Comment | ||
| #245 | BlossomThemes Email Newsletter | 23 | 337 | 239 | 20k+ | Output is not escaped | ||
| #246 | BuddyDrive | 23 | 722 | 1,597 | 1k+ | Non-prefixed global variable | ||
| #247 | Builderall for WordPress | 23 | 4,782 | 1,308 | 1k+ | Text Domain Mismatch | ||
| #248 | Announcement & Notification Banner – Bulletin | 23 | 930 | 1,576 | 2k+ | Non-prefixed global variable | ||
| #249 | Business Directory Plugin – Easy Listing Directories for WordPress | 23 | 611 | 1,063 | 10k+ | Non-prefixed global variable | ||
| #250 | Grid & Styler For Contact Form 7 And Divi | 23 | 548 | 1,341 | 500 | Non-prefixed global variable |
