PluginScore

WordPress.Security.EscapeOutput.OutputNotEscaped

Output is not escaped

Dynamic data is printed to the page without an escaping function for the output context.

critical weight

Why It Shows Up

WordPress Coding Standards detected a variable, option, request value, or function result reaching HTML output without a nearby escaping call.

Why It Matters

Unescaped output can become cross-site scripting when attackers control any part of the value being printed.

How to Fix

  • Use `esc_html()` for plain text, `esc_attr()` for attributes, and `esc_url()` for URLs.
  • Use `wp_kses()` or `wp_kses_post()` when limited HTML is intentionally allowed.
  • Escape as late as possible, right before output, so the selected escaping function matches the final context.

References

WordPress escaping functions

Affected Plugins

RankPluginScoreErrorsWarningsInstallsAddedUpdatedTop Issue
#1BulletProof Security05,0484,94920k+Output is not escaped
#2Intercom060716k+Non-prefixed function
#3Live Shopping & Shoppable Videos For WooCommerce079174400Non-prefixed global variable
#4Themify Builder95,3292,1715k+Text Domain Mismatch
#5JetBackup – Backup, Restore & Migrate101,563149200k+Exception output is not escaped
#6404 Solution155311,50710k+Non-prefixed class
#7Easy WP SMTP – WordPress SMTP and Email Logs: Gmail SMTP, Office 365, Outlook, Custom SMTP, and more1545166500k+Database parameter is not escaped
#8Visual Composer Website Builder168232040k+Non-prefixed global variable
#9MDTF – Meta Data and Taxonomies Filter161,5501,9561k+Non-prefixed global variable
#10AnyComment174454495k+Output is not escaped
#11RestroPress – Online Food Ordering System175273,1891k+Non-prefixed global variable
#12Efí Bank17886553400Exception output is not escaped
#13Dynamic Team Manager – Team Member Showcase with grid, slider, table Elementor widget & shortcode179222,014900Non-prefixed global variable
#14wpForo Forum174,3063,02620k+Unsafe printing function
#15WPtouch – Make your WordPress Website Mobile-Friendly171,46632550k+Text Domain Mismatch
#16Administrator Z182,061799400Output is not escaped
#17Pagopar – WooCommerce Gateway185301,215400Non-prefixed global variable
#18Property Hive181,9576,0273k+Missing nonce verification
#19Shopping Cart & eCommerce Store185,37317,4663k+Non-prefixed global variable
#20WPPizza – A Restaurant Plugin184,6892,7031k+Text Domain Mismatch
#21Element Pack Addons for Elementor – Elementor Widgets, Elementor Templates, Elementor Addons1910,340360100k+Text Domain Mismatch
#22Block Slider – Responsive Image Slider, Video Slider & Post Slider195551,2913k+Non-prefixed global variable
#23Advanced File Manager – Ultimate File Manager for WordPress And Document Library Solution191,227892100k+Exception output is not escaped
#24Go Fetch Jobs (for WP Job Manager)191,4101,741700Non-prefixed global variable
#25AI Infographic Maker191,383599600Output is not escaped
#26JetFormBuilder — Dynamic Blocks Form Builder192,1031,60580k+Text Domain Mismatch
#27Leaflet Maps Marker (Google Maps, OpenStreetMap, Bing Maps)193,2753,2289k+Output is not escaped
#28Matomo Analytics – Powerful, Privacy-First Insights for WordPress191,900877100k+Exception output is not escaped
#29Netgsm193343081k+Setting is missing a sanitization callback
#30Verified Reviews (Avis Vérifiés)196711,136700Non-prefixed global variable
#31Razorpay Payment Button Plugin19486982k+Exception output is not escaped
#32Really Simple Security – Simple and Performant Security (formerly Really Simple SSL)195363793m+Missing Translators Comment
#33Membership Plugin – Kadence Memberships195,0832,9829k+Text Domain Mismatch
#34Scrollsequence – Cinematic Scroll Image Animation Plugin198781,5283k+Non-prefixed global variable
#35SendPress Newsletters192,2931,4221k+Output is not escaped
#36SureCart – Ecommerce Made Easy For Selling Physical Products, Digital Downloads, Subscriptions, Donations, & Payments195331,14980k+Non-prefixed global variable
#37WP Email Template193443452k+Exception output is not escaped
#38WP Import Export Lite1973797940k+Non-prefixed global variable
#39WP Directory Kit191,5022,6412k+Non-prefixed global variable
#40WPJAM Basic193253464k+Output is not escaped
#41WPOSS阿里云对象存储19269315900Non-prefixed namespace
#42WPQiNiu七牛云对象存储19138612400Non-prefixed global variable
#43AweBooking – Hotel Booking System203095141k+Non-prefixed global variable
#44Brizy – Page Builder2058672670k+Output is not escaped
#45Broadstreet20434273700Output is not escaped
#46Post Form – Registration Form – Profile Form for User Profiles – Frontend Content Forms for User Submissions (UGC)207362,112900Non-prefixed global variable
#47SysBasics Customize My Account for WooCommerce – Live My Account Customizer207439118k+Non-prefixed global variable
#48Download Monitor204231,36480k+Non-prefixed hook name
#49Event Espresso – Event Registration & Ticketing Sales2012,6982,135600Text Domain Mismatch
#50Event Organiser201,10454420k+Text Domain Mismatch