WordPress.Security.EscapeOutput.ExceptionNotEscaped
Exception output is not escaped
An exception message or related exception value is printed without escaping.
Why It Shows Up
The scan found exception data being displayed directly in HTML output.
Why It Matters
Exception messages can include file paths, request values, remote API responses, or database details. Printing them raw can expose information or create XSS risk.
How to Fix
- Use `esc_html()` or another context-appropriate escaping function before displaying exception text.
- Show a generic user-facing message and log the detailed exception for administrators or developers.
- Do not print stack traces, paths, or raw remote responses on public pages.
References
Affected Plugins
| Rank | Plugin | Score | Errors | Warnings | Installs | Added | Updated | Top Issue |
|---|---|---|---|---|---|---|---|---|
| #251 | Content Egg – Affiliate Product Importer & Price Comparison | 23 | 1,245 | 1,275 | 10k+ | Non-prefixed global variable | ||
| #252 | Free Theme Builder for Elementor – CRT Addons (Header, Footer, Archive, WooCommerce & 50+ Widgets) | 23 | 791 | 2,331 | 400 | Non-prefixed global variable | ||
| #253 | Auto Post Cleaner | 23 | 715 | 1,378 | 1k+ | Non-prefixed global variable | ||
| #254 | Disable Bloat for WordPress & WooCommerce | 23 | 863 | 1,325 | 10k+ | Non-prefixed global variable | ||
| #255 | DK PDF – WordPress PDF Generator | 23 | 744 | 335 | 3k+ | Exception output is not escaped | ||
| #256 | Dokan: AI Powered WooCommerce Multivendor Marketplace Solution – Build Your Own Amazon, eBay, Etsy | 23 | 170 | 821 | 40k+ | Non-prefixed global variable | ||
| #257 | Easy Age Verify | 23 | 1,138 | 2,631 | 1k+ | Non-prefixed global variable | ||
| #258 | Easy Digital Downloads – eCommerce Payments and Subscriptions made easy | 23 | 3,723 | 10,283 | 40k+ | Non-prefixed namespace | ||
| #259 | Marijuana Age Verify | 23 | 1,154 | 2,630 | 1k+ | Non-prefixed global variable | ||
| #260 | Ecwid by Lightspeed Ecommerce Shopping Cart | 23 | 339 | 307 | 20k+ | Missing direct file access protection | ||
| #261 | Error Log Monitor | 23 | 694 | 1,414 | 20k+ | Non-prefixed global variable | ||
| #262 | Essential Real Estate | 23 | 529 | 5,060 | 8k+ | Non-prefixed global variable | ||
| #263 | Events Addon for Elementor | 23 | 779 | 1,339 | 7k+ | Non-prefixed global variable | ||
| #264 | Fastcache by Host.it | 23 | 1,327 | 203 | 800 | Text Domain Mismatch | ||
| #265 | Featured Images in RSS for Mailchimp & More | 23 | 780 | 1,299 | 20k+ | Non-prefixed global variable | ||
| #266 | Filr – Secure document library | 23 | 775 | 1,317 | 700 | Non-prefixed global variable | ||
| #267 | Finpose – Accounting for WooCommerce | 23 | 1,649 | 1,307 | 400 | Non-prefixed global variable | ||
| #268 | Image Photo Gallery Final Tiles Grid | 23 | 578 | 1,502 | 20k+ | Non-prefixed global variable | ||
| #269 | Five-Star Ratings Shortcode | 23 | 604 | 1,317 | 600 | Non-prefixed global variable | ||
| #270 | Freshdesk (official) | 23 | 194 | 386 | 900 | Non-prefixed function | ||
| #271 | Front End PM | 23 | 978 | 2,264 | 5k+ | Non-prefixed global variable | ||
| #272 | Tracking and Consent Manager – WP Full Picture | 23 | 1,280 | 3,223 | 3k+ | Non-prefixed global variable | ||
| #273 | Futurio Extra | 23 | 787 | 205 | 20k+ | Text Domain Mismatch | ||
| #274 | FV Flowplayer Video Player | 23 | 1,311 | 1,454 | 20k+ | Output is not escaped | ||
| #275 | GAinWP Google Analytics Integration for WordPress | 23 | 525 | 176 | 8k+ | Output is not escaped | ||
| #276 | GamiPress – Gamification plugin to reward points, achievements, badges & ranks in WordPress | 23 | 3,590 | 2,771 | 10k+ | Output is not escaped | ||
| #277 | Gmedia Photo Gallery | 23 | 350 | 1,121 | 7k+ | Non-prefixed global variable | ||
| #278 | Interactive Content – H5P | 23 | 565 | 380 | 40k+ | Non Singular String Literal Domain | ||
| #279 | Happy Addons for Elementor | 23 | 573 | 444 | 400k+ | Output is not escaped | ||
| #280 | Houzez Property Feed | 23 | 1,464 | 1,585 | 1k+ | Text Domain Mismatch | ||
| #281 | Iks Menu – WordPress Category Accordion Menu & FAQs | 23 | 615 | 1,293 | 10k+ | Non-prefixed global variable | ||
| #282 | Image Carousel For Divi | 23 | 569 | 1,309 | 1k+ | Non-prefixed global variable | ||
| #283 | RealHomes Memberships | 23 | 516 | 264 | 1k+ | Non Singular String Literal Domain | ||
| #284 | Payment forms, Buy now buttons, and Invoicing System | GetPaid | 23 | 389 | 1,266 | 5k+ | Non-prefixed global variable | ||
| #285 | IP Geo Block | 23 | 399 | 589 | 8k+ | Output is not escaped | ||
| #286 | Jeg Kit for Elementor – Powerful Addons for Elementor, Widgets & Templates for WordPress | 23 | 91 | 694 | 300k+ | Non-prefixed namespace | ||
| #287 | Joli FAQ SEO – WordPress FAQ Plugin | 23 | 1,083 | 1,526 | 700 | Non-prefixed global variable | ||
| #288 | Justified Gallery | 23 | 589 | 1,417 | 8k+ | Non-prefixed global variable | ||
| #289 | Kadence Blocks — Page Builder Toolkit for Gutenberg Editor | 23 | 55 | 2,127 | 600k+ | Non-prefixed global variable | ||
| #290 | Kenta Companion | 23 | 657 | 1,419 | 2k+ | Non-prefixed global variable | ||
| #291 | King Addons for Elementor – 80+ Elementor Widgets, 4 000+ Elementor Templates, WooCommerce, Mega Menu, Popup Builder | 23 | 1,832 | 3,877 | 10k+ | Non-prefixed global variable | ||
| #292 | Masteriyo LMS – LMS Course Builder, Quizzes & Certificates | 23 | 190 | 2,122 | 5k+ | Non-prefixed global variable | ||
| #293 | Link Whisper Free | 23 | 3,882 | 5,303 | 30k+ | Text Domain Mismatch | ||
| #294 | LLMagnet – AI Visibility & AI SEO for Claude, ChatGPT & More | 23 | 627 | 1,798 | 400 | Non-prefixed global variable | ||
| #295 | Custom Login Page Customizer | 23 | 687 | 1,408 | 90k+ | Non-prefixed global variable | ||
| #296 | Login With Ajax – Fast Logins, 2FA, Redirects | 23 | 623 | 520 | 10k+ | Output is not escaped | ||
| #297 | MailPoet – Newsletters, Email Marketing, and Automation | 23 | 932 | 718 | 500k+ | Exception output is not escaped | ||
| #298 | Master Addons For Elementor – Widgets, Extensions, Theme Builder, Popup Builder & Template Kits | 23 | 525 | 1,541 | 30k+ | Non-prefixed global variable | ||
| #299 | MasterStudy LMS WordPress Plugin – for Online Courses and Education | 23 | 1,419 | 4,875 | 10k+ | Non-prefixed global variable | ||
| #300 | Media Library File Download | 23 | 615 | 1,286 | 1k+ | Non-prefixed global variable |
