PluginScore

WordPress.Security.EscapeOutput.ExceptionNotEscaped

Exception output is not escaped

An exception message or related exception value is printed without escaping.

critical weight

Why It Shows Up

The scan found exception data being displayed directly in HTML output.

Why It Matters

Exception messages can include file paths, request values, remote API responses, or database details. Printing them raw can expose information or create XSS risk.

How to Fix

  • Use `esc_html()` or another context-appropriate escaping function before displaying exception text.
  • Show a generic user-facing message and log the detailed exception for administrators or developers.
  • Do not print stack traces, paths, or raw remote responses on public pages.

References

WordPress escaping functions

Affected Plugins

RankPluginScoreErrorsWarningsInstallsAddedUpdatedTop Issue
#351Easy Appointment Booking & Scheduling System – Webba Booking Calendar231,6183,3782k+Non-prefixed global variable
#352WHMCS Bridge232474724k+Nonce verification recommended
#353Widgets on Pages238091,30620k+Non-prefixed global variable
#354Billingo Plus integráció WooCommerce-hez231,119507900Text Domain Mismatch
#355PostFinance Checkout239792141k+Text Domain Mismatch
#356Widgets for WooCommerce Products on Elementor231,6591,4543k+Non-prefixed global variable
#357Predictive Search for WooCommerce23514633700Output is not escaped
#358WP All Import – Product Import for WooCommerce231,47520920k+Non Singular String Literal Domain
#359StoreCustomizer – A plugin to Customize all WooCommerce Pages235871,42620k+Non-prefixed global variable
#360ShopLentor – All-in-One WooCommerce Growth & Store Enhancement Plugin237,8802,19990k+Text Domain Mismatch
#361Worth The Read238731383k+Text Domain Mismatch
#362WP Editor2350233520k+Unsafe printing function
#363WP Free SSL237351,3451k+Non-prefixed global variable
#364Stripe Payment Forms by WP Full Pay – Accept Credit Card Payments, Donations & Subscriptions231,1131,8629k+Output is not escaped
#365WP-Lister Lite for Amazon233,0614,177800Output is not escaped
#366FunnelKit Automations – Email Marketing Automation and CRM for WordPress & WooCommerce239412,17920k+SQL query is not prepared
#367WP Migrate Lite – Migration Made Easy23369255200k+Exception output is not escaped
#368Shield Security – Smart Bot Blocking, Brute-Force Login Protection & File Scanning231,11820230k+Missing Translators Comment
#369WP STAGING – WordPress Backup, Restore, Migration & Clone231,5041,607100k+Non-prefixed global variable
#370Subscribe Forms – Beautiful Email Forms, Embedded Newsletter Forms & MailChimp Form234195422k+Non-prefixed global variable
#371Track, Analyze & Optimize by WP Tao23895756600Output is not escaped
#372Dynamic Team Manager – Team Member Showcase with grid, slider, table Elementor widget & shortcode239072,014900Non-prefixed global variable
#373Customer Support Ticket System & Helpdesk231,7191,464400Text Domain Mismatch
#374Divi Gravity Forms (WP Tools)235791,3112k+Non-prefixed global variable
#375WP Ultimate CSV Importer – WordPress Import & Export for CSV, XML & Excel231,1583,64220k+Interpolated SQL is not prepared
#376WPMobile.App232,9831,5333k+Output is not escaped
#377WPCal.io – Easy Meeting Scheduler23694595900Direct Query
#378Masonry Gallery & Posts For Divi (WP Tools)237541,450800Non-prefixed global variable
#379WSW – Shopify WooCommerce / WordPress Integration and Migration231,4491,612500Non-prefixed global variable
#380XT Ajax Add To Cart for WooCommerce231,0031,6901k+Non-prefixed global variable
#381XT Quick View for WooCommerce231,0791,829400Non-prefixed global variable
#382XT Variation Swatches for WooCommerce231,0511,834500Non-prefixed global variable
#383Yatra – Travel Booking & Tour Operator Software232,2364,024600Non-prefixed global variable
#384YITH Essential Kit for WooCommerce #1233971,4815k+Non-prefixed global variable
#385YITH PayPal Express Checkout for WooCommerce233871,4431k+Non-prefixed global variable
#386YITH WooCommerce Affiliates235491,5276k+Non-prefixed global variable
#387YITH WooCommerce Ajax Product Filter234631,52780k+Non-prefixed global variable
#388Youzify – BuddyPress Community, User Profile, Social Network & Membership Plugin for WordPress232,3171,7145k+Output is not escaped
#389Zephyr Project Manager236672,4541k+Non-prefixed global variable
#3901 Click Migration & Backup: Free WordPress Migration Plugin with Zero Downtime & Easy Clone24140193400Direct Query
#391404 Solution244831,35510k+Non-prefixed class
#392A2 Optimized WP – Turbocharge and secure your WordPress site2427123160k+Missing Arg Domain
#393AcyMailing – An Ultimate Newsletter Plugin and Marketing Automation Solution for WordPress245,2341,4647k+Output is not escaped
#394Ad Inserter – Ad Manager & AdSense Ads244,260812300k+Output is not escaped
#395Ivory Search – WordPress Search Plugin241,1731,688100k+Non-prefixed global variable
#396Advanced Contact form 7 DB247641,96070k+Non-prefixed global variable
#397Affiliates Manager241,2686538k+Unsafe printing function
#398All Embed – Multi-Source Embed Widgets for Elementor247291,310600Non-prefixed global variable
#399All-In-One Security (AIOS) – Security and Firewall245521,2281m+Non-prefixed global variable
#400Starter Templates – AI-Powered Templates for Elementor & Gutenberg241254011m+Non-prefixed hook name