WordPress.Security.EscapeOutput.OutputNotEscaped
Output is not escaped
Dynamic data is printed to the page without an escaping function for the output context.
Why It Shows Up
WordPress Coding Standards detected a variable, option, request value, or function result reaching HTML output without a nearby escaping call.
Why It Matters
Unescaped output can become cross-site scripting when attackers control any part of the value being printed.
How to Fix
- Use `esc_html()` for plain text, `esc_attr()` for attributes, and `esc_url()` for URLs.
- Use `wp_kses()` or `wp_kses_post()` when limited HTML is intentionally allowed.
- Escape as late as possible, right before output, so the selected escaping function matches the final context.
References
Affected Plugins
| Rank | Plugin | Score | Errors | Warnings | Installs | Added | Updated | Top Issue |
|---|---|---|---|---|---|---|---|---|
| #5051 | RevivePress – Keep your Old Content Evergreen | 59 | 27 | 46 | 5k+ | date date | ||
| #5052 | Add Google re captcha in WordPress Forms | 59 | 16 | 16 | 500 | Output is not escaped | ||
| #5053 | WP Shortcode by MyThemeShop | 59 | 32 | 5 | 10k+ | Output is not escaped | ||
| #5054 | WPML Widgets | 59 | 9 | 9 | 9k+ | Unsafe printing function | ||
| #5055 | Accesibilidad Web con el Widget de AccedeMe | 60 | 22 | 23 | 1k+ | Text Domain Mismatch | ||
| #5056 | Admin Menu Groups | 60 | 26 | 10 | 800 | Output is not escaped | ||
| #5057 | Bandsintown Events | 60 | 80 | 28 | 4k+ | wp function not compatible with requires wp | ||
| #5058 | Post Blocks & Tools | 60 | 9 | 46 | 400 | Missing nonce verification | ||
| #5059 | Contact Form 7 – Phone mask field | 60 | 21 | 7 | 20k+ | Unsafe printing function | ||
| #5060 | Contact Form 7 Modules | 60 | 47 | 15 | 5k+ | Text Domain Mismatch | ||
| #5061 | Disable Emails | 60 | 25 | 16 | 30k+ | Short PHP open tag found | ||
| #5062 | EPROLO-Dropshipping | 60 | 16 | 34 | 1k+ | Missing nonce verification | ||
| #5063 | FancyBox for WordPress | 60 | 175 | 33 | 30k+ | Text Domain Mismatch | ||
| #5064 | Flat Rate per State/Country/Region for WooCommerce | 60 | 27 | 4 | 1k+ | Output is not escaped | ||
| #5065 | Freshchat | 60 | 16 | 10 | 1k+ | Output is not escaped | ||
| #5066 | GamiPress – Button | 60 | 34 | 8 | 900 | Text Domain Mismatch | ||
| #5067 | Genesis Featured Widget Amplified | 60 | 126 | 12 | 2k+ | Text Domain Mismatch | ||
| #5068 | Interactive Polish Map | 60 | 30 | 4 | 500 | Output is not escaped | ||
| #5069 | iubenda | All-in-one Compliance for GDPR / CCPA Cookie Consent + more | 60 | 405 | 271 | 200k+ | Text Domain Mismatch | ||
| #5070 | Just Responsive Images | 60 | 25 | 7 | 500 | Missing direct file access protection | ||
| #5071 | Kubio AI Page Builder | 60 | 283 | 77 | 90k+ | Missing direct file access protection | ||
| #5072 | Mailster AmazonSES Integration | 60 | 52 | 25 | 1k+ | Missing Arg Domain | ||
| #5073 | Product Labels, Quick View, Buy Now, Pre-Orders, Frequently Bought Together & More for WooCommerce – Merchant | 60 | 11 | 740 | 9k+ | Non-prefixed global variable | ||
| #5074 | Post Duplicator | 60 | 33 | 24 | 200k+ | Missing direct file access protection | ||
| #5075 | Real Accessability | 60 | 21 | 9 | 1k+ | Output is not escaped | ||
| #5076 | RealHomes PayPal Payments | 60 | 55 | 23 | 400 | Non Singular String Literal Domain | ||
| #5077 | Responsive videos – Fitvids | 60 | 26 | 3 | 700 | Output is not escaped | ||
| #5078 | Simple Owl Carousel | 60 | 23 | 13 | 500 | Missing Translators Comment | ||
| #5079 | Skyboot Custom Icons for Elementor – Elementor Icons library – 14300+ Icons | 60 | 91 | 9 | 200k+ | Text Domain Mismatch | ||
| #5080 | Stratum Widgets for Elementor | 60 | 66 | 366 | 20k+ | Non-prefixed global variable | ||
| #5081 | Surge | 60 | 46 | 47 | 4k+ | Non-prefixed global variable | ||
| #5082 | Tabby Responsive Tabs | 60 | 16 | 5 | 10k+ | Output is not escaped | ||
| #5083 | Team – Team Members Showcase Plugin | 60 | 12 | 781 | 10k+ | Non-prefixed global variable | ||
| #5084 | WoowGallery | 60 | 15 | 178 | 1k+ | Non-prefixed global variable | ||
| #5085 | WP Blog Post Layouts | 60 | 36 | 249 | 10k+ | Non-prefixed global variable | ||
| #5086 | WP Bottom Menu | 60 | 74 | 52 | 20k+ | Non-prefixed hook name | ||
| #5087 | WP-SWFObject | 60 | 14 | 24 | 1k+ | Deprecated parameter: add_option parameter 3 | ||
| #5088 | WPB Popup for Contact Form 7 – Showing Contact Form 7 Popup on Button Click | 60 | 21 | 9 | 6k+ | Output is not escaped | ||
| #5089 | Accessibility Font Resizer | 61 | 54 | 1 | 800 | Text Domain Mismatch | ||
| #5090 | Add Quantity Field on Shop Page for WooCommerce | 61 | 33 | 7 | 700 | Output is not escaped | ||
| #5091 | In-Post Ads | 61 | 27 | 10 | 600 | Text Domain Mismatch | ||
| #5092 | Alerts for Beaver Builder | 61 | 42 | 1 | 500 | Output is not escaped | ||
| #5093 | Custom Buttons for WooCommerce – Add To Cart Button for Product Types | 61 | 58 | 4 | 2k+ | Text Domain Mismatch | ||
| #5094 | Comment Form WP – Customize Default Comment Form | 61 | 39 | 7 | 600 | Output is not escaped | ||
| #5095 | Compact WP Audio Player | 61 | 12 | 21 | 20k+ | Non-prefixed function | ||
| #5096 | Constructor for SiteOrigin | 61 | 29 | 6 | 600 | Output is not escaped | ||
| #5097 | Creative Commons | 61 | 103 | 17 | 700 | Text Domain Mismatch | ||
| #5098 | Disable Right Click For WP | 61 | 15 | 12 | 10k+ | Missing nonce verification | ||
| #5099 | Documents for WooCommerce | 61 | 16 | 13 | 500 | Output is not escaped | ||
| #5100 | ELEX WooCommerce Catalog Mode | 61 | 97 | 49 | 10k+ | Text Domain Mismatch |
