PluginScore

WordPress.Security.EscapeOutput.ExceptionNotEscaped

Exception output is not escaped

An exception message or related exception value is printed without escaping.

critical weight

Why It Shows Up

The scan found exception data being displayed directly in HTML output.

Why It Matters

Exception messages can include file paths, request values, remote API responses, or database details. Printing them raw can expose information or create XSS risk.

How to Fix

  • Use `esc_html()` or another context-appropriate escaping function before displaying exception text.
  • Show a generic user-facing message and log the detailed exception for administrators or developers.
  • Do not print stack traces, paths, or raw remote responses on public pages.

References

WordPress escaping functions

Affected Plugins

RankPluginScoreErrorsWarningsInstallsAddedUpdatedTop Issue
#301Menu Image, Icons made easy235911,406100k+Non-prefixed global variable
#302Moloni239013562k+Missing Arg Domain
#303MotoPress Appointment Booking232,3628572k+Text Domain Mismatch
#304Restaurant Menu and Food Ordering233858532k+Non-prefixed global variable
#305MP3 Audio Player – Music Player, Podcast Player & Radio by Sonaar234,06548820k+Text Domain Mismatch
#306MStore API – Create Native Android & iOS Apps On The Cloud236187643k+SQL query is not prepared
#307MPG – Multiple Page Generator, Bulk Landing Pages & Programmatic SEO234855802k+Missing nonce verification
#308Simple Newsletter Plugin – Noptin237159310k+Non-prefixed global variable
#309Next Active Directory Integration236832842k+Exception output is not escaped
#310Photo Gallery, Sliders, Proofing and Themes – NextGEN Gallery232,129993400k+Text Domain Mismatch
#311NicheTable – Responsive Comparison Table Block236831,307700Non-prefixed global variable
#312NitroPack – Performance, Page Speed & Cache Plugin for Core Web Vitals, CDN & Image Optimization2331663990k+Output is not escaped
#313Ocean Extra231,4942,107500k+Non-prefixed global variable
#314Issues and Series for Newspapers, Magazines, Publishers, Writers233467102k+Nonce verification recommended
#315Gallery PhotoBlocks239041,3453k+Non-prefixed global variable
#316ExpressTechSoftwares Discord Add-on for Paid Memberships Pro23454449700Text Domain Mismatch
#317Post to Google My Business (Google Business Profile)238451,45210k+Non-prefixed global variable
#318Postie2340825910k+Output is not escaped
#319PowerPress Podcasting plugin by Blubrry234,8152,45220k+Output is not escaped
#320Pricing Table by Supsystic231,29944710k+Non Singular String Literal Domain
#321Primary Addon for Elementor237651,3067k+Non-prefixed global variable
#322Print Anywhere & Create PDFs of Order Receipts, Invoices, Labels & More.231,4854441k+Text Domain Mismatch
#323Print My Blog – Print, PDF, & eBook Converter WordPress Plugin231,0771,6608k+Non-prefixed global variable
#324Protect Admin236061,3002k+Non-prefixed global variable
#325Radio Station by netmix® – Manage and play your Show Schedule in WordPress!239343,6191k+Non-prefixed global variable
#326Read More Without Refresh239551,34720k+Non-prefixed global variable
#327Read More WP235701,3111k+Non-prefixed global variable
#328Real 3D Flipbook – 3D FlipBook, PDF FlipBook, PDF Viewer, PDF Embedder239081,37710k+Non-prefixed global variable
#329Restaurant & Cafe Addon for Elementor238891,3261k+Non-prefixed global variable
#330Revive.so – Bulk Rewrite and Republish Blog Posts23332228700Text Domain Mismatch
#331Robo Gallery – Photo & Image Slider231,29153040k+Output is not escaped
#332Manago AI & Leadoo AI236444291k+Unsafe printing function
#333Seriously Simple Podcasting2354862930k+Non-prefixed hook name
#334Local Google Analytics for WordPress – caches external requests235511993k+Output is not escaped
#335Simple URLs – Link Cloaking, Product Displays, and Affiliate Link Management232952984k+Non-prefixed global variable
#336Site Reviews231,62660460k+Output is not escaped
#337Smart Slider 323261268800k+Non-prefixed global variable
#338SportsPress – Sports Club & League Manager234592,24610k+Non-prefixed global variable
#339StreamWeasels Twitch Integration235551,4651k+Non-prefixed global variable
#340Super Video player – Fully Customizable Video Player with Playlist231,1351,6342k+Non-prefixed global variable
#341The Events Calendar233,5093,850700k+Text Domain Mismatch
#342Travelpayouts237691106k+Output is not escaped
#343Directory Listings WordPress plugin – uListing239471,5731k+Non-prefixed global variable
#344Product Options and Price Calculation Formulas for WooCommerce – Uni CPO232,5141,9291k+Output is not escaped
#345User Menus – Nav Menu Visibility235311,29880k+Non-prefixed global variable
#346UsersWP – Front-end login form, User Registration, User Profile & Members Directory plugin for WP236942,43920k+Non-prefixed hook name
#347W3 Total Cache23307678900k+Non-prefixed global variable
#348Wallet System for WooCommerce – Digital Wallet, Buy Now Pay Later (BNPL), Instant Cashback, Referral program, Partial & Subscription Payments231211,2272k+Non-prefixed global variable
#349Cart PDF for WooCommerce235311721k+Exception output is not escaped
#350Checkout with Zelle on Woocommerce236371,4043k+Non-prefixed global variable