WordPress.Security.EscapeOutput.OutputNotEscaped
Output is not escaped
Dynamic data is printed to the page without an escaping function for the output context.
Why It Shows Up
WordPress Coding Standards detected a variable, option, request value, or function result reaching HTML output without a nearby escaping call.
Why It Matters
Unescaped output can become cross-site scripting when attackers control any part of the value being printed.
How to Fix
- Use `esc_html()` for plain text, `esc_attr()` for attributes, and `esc_url()` for URLs.
- Use `wp_kses()` or `wp_kses_post()` when limited HTML is intentionally allowed.
- Escape as late as possible, right before output, so the selected escaping function matches the final context.
References
Affected Plugins
| Rank | Plugin | Score | Errors | Warnings | Installs | Added | Updated | Top Issue |
|---|---|---|---|---|---|---|---|---|
| #5701 | Post Carousel for DV Builder | 74 | 152 | 9 | 2k+ | Text Domain Mismatch | ||
| #5702 | Post Grid Addon for Elementor | 74 | 16 | 13 | 10k+ | Missing direct file access protection | ||
| #5703 | Post My CF7 Form | 74 | 21 | 168 | 2k+ | Non-prefixed global variable | ||
| #5704 | Product Layouts for WooCommerce | 74 | 5 | 75 | 1k+ | Direct Query | ||
| #5705 | WP All Import – Property Import for RealHomes | 74 | 17 | 12 | 700 | Output is not escaped | ||
| #5706 | Resume Builder | 74 | 20 | 59 | 1k+ | Non-prefixed global variable | ||
| #5707 | Scroll to Top Button | 74 | 16 | 4 | 1k+ | Output is not escaped | ||
| #5708 | Security Headers | 74 | 31 | 11 | 3k+ | Deprecated parameter: unregister_setting parameter 3 | ||
| #5709 | Show Pages IDs | 74 | 8 | 8 | 10k+ | Output is not escaped | ||
| #5710 | Simple Scroll To Top WP | 74 | 24 | 5 | 1k+ | Output is not escaped | ||
| #5711 | Simple Slug Translate | 74 | 32 | 3 | 1k+ | Non Singular String Literal Domain | ||
| #5712 | Simply Excerpts | 74 | 12 | 1 | 500 | Setting is missing a sanitization callback | ||
| #5713 | Email Deliverability – SMTP Replacement, Email API Deliverability & Email Log | 74 | 8 | 23 | 200k+ | Output is not escaped | ||
| #5714 | Sticky Custom Post Types | 74 | 15 | 0 | 500 | Missing Arg Domain | ||
| #5715 | Change Storefront Footer Copyright Text | 74 | 71 | 21 | 4k+ | Text Domain Mismatch | ||
| #5716 | Extra Shipping Rates for WooCommerce | 74 | 15 | 19 | 800 | Non-prefixed global variable | ||
| #5717 | Widgets in Menu for WordPress | 74 | 16 | 12 | 8k+ | Text Domain Mismatch | ||
| #5718 | WP Cron HTTP Auth | 74 | 12 | 7 | 1k+ | Output is not escaped | ||
| #5719 | Force Login | 74 | 5 | 8 | 30k+ | Output is not escaped | ||
| #5720 | WP Revisions Limit | 74 | 16 | 14 | 800 | Missing Arg Domain | ||
| #5721 | WP Term Colors | 74 | 3 | 13 | 700 | Nonce verification recommended | ||
| #5722 | Zion Builder – Website Builder for Speed & Creativity | 74 | 4 | 29 | 1k+ | Non-prefixed hook name | ||
| #5723 | Accordion Shortcode | 75 | 17 | 0 | 400 | Output is not escaped | ||
| #5724 | Acumbamail | 75 | 7 | 36 | 1k+ | Non-prefixed global variable | ||
| #5725 | Admin Locale | 75 | 12 | 10 | 7k+ | Missing Arg Domain | ||
| #5726 | Anchor Episodes Index (Spotify for Podcasters) | 75 | 32 | 3 | 1k+ | Text Domain Mismatch | ||
| #5727 | Beacon Lead Magnets and Lead Capture | 75 | 8 | 25 | 500 | Nonce verification recommended | ||
| #5728 | blueimp lightbox | 75 | 19 | 2 | 1k+ | Output is not escaped | ||
| #5729 | Bulk Comments Management | 75 | 6 | 25 | 700 | Direct Query | ||
| #5730 | Canvas Image Resize | 75 | 19 | 1 | 1k+ | Output is not escaped | ||
| #5731 | chat-me-now | 75 | 15 | 5 | 4k+ | Output is not escaped | ||
| #5732 | Cognito Forms | 75 | 13 | 4 | 2k+ | wp function not compatible with requires wp | ||
| #5733 | Colored Admin Post List | 75 | 8 | 0 | 500 | Heredoc Output Not Escaped | ||
| #5734 | Conditional Logic Emails, Fields, Redirect for Elementor Forms | 75 | 312 | 31 | 2k+ | wp function not compatible with requires wp | ||
| #5735 | Custom field finder | 75 | 9 | 3 | 2k+ | Output is not escaped | ||
| #5736 | Customize Twenty Seventeen | 75 | 33 | 19 | 2k+ | Text Domain Mismatch | ||
| #5737 | Customize Twenty Sixteen | 75 | 32 | 11 | 500 | Text Domain Mismatch | ||
| #5738 | Delay Redirects | 75 | 5 | 8 | 900 | Request data is not unslashed | ||
| #5739 | En Spam | 75 | 21 | 6 | 500 | wp function not compatible with requires wp | ||
| #5740 | Eventin Addons for Divi Builder | 75 | 6 | 17 | 800 | Nonce verification recommended | ||
| #5741 | FareHarbor for WordPress | 75 | 18 | 9 | 9k+ | Output is not escaped | ||
| #5742 | Force First and Last Name as Display Name | 75 | 5 | 12 | 2k+ | Missing nonce verification | ||
| #5743 | Gradient Button for Elementor | 75 | 16 | 4 | 2k+ | Output is not escaped | ||
| #5744 | Hum | 75 | 8 | 2 | 600 | wp function not compatible with requires wp | ||
| #5745 | List all URLs | 75 | 8 | 5 | 5k+ | Missing nonce verification | ||
| #5746 | Open Graph Protocol Framework | 75 | 17 | 12 | 3k+ | Missing direct file access protection | ||
| #5747 | Options Framework | 75 | 8 | 56 | 10k+ | Non-prefixed function | ||
| #5748 | PJ News Ticker | 75 | 13 | 14 | 3k+ | Output is not escaped | ||
| #5749 | Post Type Switcher | 75 | 3 | 18 | 200k+ | Direct Query | ||
| #5750 | Logos Reftagger | 75 | 12 | 15 | 10k+ | Deprecated parameter: add_option parameter 3 |
