PluginScore

WordPress.Security.EscapeOutput.ExceptionNotEscaped

Exception output is not escaped

An exception message or related exception value is printed without escaping.

critical weight

Why It Shows Up

The scan found exception data being displayed directly in HTML output.

Why It Matters

Exception messages can include file paths, request values, remote API responses, or database details. Printing them raw can expose information or create XSS risk.

How to Fix

  • Use `esc_html()` or another context-appropriate escaping function before displaying exception text.
  • Show a generic user-facing message and log the detailed exception for administrators or developers.
  • Do not print stack traces, paths, or raw remote responses on public pages.

References

WordPress escaping functions

Affected Plugins

RankPluginScoreErrorsWarningsInstallsAddedUpdatedTop Issue
#401Starter Templates – AI-Powered Templates for Elementor & Gutenberg241254011m+Non-prefixed hook name
#402Multi Page Auto Advance for Gravity Forms246531,3352k+Non-prefixed global variable
#403Auto-Install Free SSL – Generate & Install Free SSL Certificates249911,4958k+Non-prefixed global variable
#404TermsFeed AutoTerms: Privacy Policy Generator, Cookie Consent, GDPR, CCPA, Terms & Conditions, Disclaimers, Cookies Policy, EULA2493916170k+Non Singular String Literal Domain
#405AutomatorWP – Automator plugin for no-code automations, webhooks & custom integrations in WordPress241,7051,3937k+Text Domain Mismatch
#406bBlocks – Essential Gutenberg Blocks & Patterns Collection246561,511700Non-prefixed global variable
#407Backuply – Backup, Restore, Migrate and Clone24704551700k+Non-prefixed global variable
#408Banner Management For WooCommerce248651,8622k+Non-prefixed global variable
#409Barcode Scanner (+Mobile App) – Inventory manager, Order fulfillment system, POS (Point of Sale)241,8651,0891k+Text Domain Mismatch
#410Product Feed Manager For WooCommerce – Sell on 200+ Online Marketplaces242,3173,37510k+slow db query meta key
#411Better Payment – Instant Payments, Donations, Fundraising with Subscriptions & More243429306k+Non-prefixed global variable
#412BlockMeister – Block Pattern Builder245801,4051k+Non-prefixed global variable
#413Blog Designer Pack – Blog, Post Grid, Post Slider, Post Carousel, Category Post, News246991,69330k+Non-prefixed global variable
#414BrikPanel: WooCommerce Dashboard, Abandoned Cart Recovery, Google Sheets Sync, Inventory Management & Bulk Editor244,2611,423500Text Domain Mismatch
#415Builderall for WordPress244,7781,3071k+Text Domain Mismatch
#416Buttonizer – Floating Menus, Sticky Buttons, & Popup Builder245761,34470k+Non-prefixed global variable
#417Calculated Fields Form – AI Form Builder for WordPress – Contact, Payment, Quote, Quiz & More2434460940k+Non-prefixed global variable
#418Categorify – WordPress Media Library Category & File Manager245731,3851k+Non-prefixed global variable
#419Message Filter for Contact Form 7241,0571,5941k+Non-prefixed global variable
#420Business Essentials for Contact Form 7246744038k+Text Domain Mismatch
#421WOW Styler for CF7 – Visual Styler for Contact Form 7 Forms245341,5593k+Non-prefixed global variable
#422Church Admin241,5544,207900Direct Query
#423CleanTalk Anti-Spam. Spam Firewall & Bot protection248181,092200k+Missing nonce verification
#424Smart Online Order for Clover241,7461,2461k+Text Domain Mismatch
#425Complianz – GDPR/CCPA Cookie Consent244874031m+Missing Arg Domain
#426CF7 Apps – Honeypot, Database, Redirection, Webhook, and Addons for Contact Form 7241,0341,396300k+Non-prefixed global variable
#427Contact Form by Supsystic241,9136336k+Non Singular String Literal Domain
#428Contact Widgets For Elementor all the contact links you need in one place249081,188500Non-prefixed global variable
#429WPBot – ChatBot Conversational Forms241,2541,2262k+Text Domain Mismatch
#430Custom CSS247036571k+Output is not escaped
#431WP Customer Area243,30694110k+Text Domain Mismatch
#432Customer Reviews for WooCommerce242,2022,44580k+Output is not escaped
#433Defender Security – Malware Scanner, Login Security & Firewall2454759480k+Non-prefixed namespace
#434WP Comment Cleaner – Delete All Comments, Disable Comments, Bulk Delete & Remove Comments245871,43020k+Non-prefixed global variable
#435WP Delicious – Recipe Plugin for Food Bloggers (formerly Delicious Recipes)248452,6434k+Non-prefixed global variable
#436Democracy Poll243874367k+Short PHP open tag found
#437Deployer for Git245411,336500Non-prefixed global variable
#438DFX Automatic Role Changer for WooCommerce245971,308400Non-prefixed global variable
#439Digital License Manager24295670800Non-prefixed hook name
#440Double Opt-In for Contact Form 7 – Secure, GDPR-Compliant Email Verification242334411k+Non-prefixed hook name
#441Doubly – Cross Domain Copy Paste for WordPress242525510k+Output is not escaped
#442Drop Shadow Boxes246421,2904k+Non-prefixed global variable
#443Easy Invoice – Invoice Generator, PDF Quotes & Payments241,3662,013500Non-prefixed global variable
#444ELEX WooCommerce Request a Quote243982662k+Request data is not unslashed
#445Email Subscribers & Newsletters – Email Marketing, Post Notifications & Newsletter Plugin for WordPress246521,49560k+Non-prefixed hook name
#446EmbedPress – PDF Embedder, 3D PDF FlipBook, Google Reviews, YouTube Videos, Upload & Embed PDF documents247111,588100k+Output is not escaped
#447Event Tickets and Registration243,4094,21790k+Non-prefixed global variable
#448Etsy Integration For WooCommerce241,2464,643900Non-prefixed global variable
#449Fast Velocity Minify2428225640k+Unsafe printing function
#450Fattura2424312333400Output is not escaped