WordPress.Security.EscapeOutput.OutputNotEscaped
Output is not escaped
Dynamic data is printed to the page without an escaping function for the output context.
Why It Shows Up
WordPress Coding Standards detected a variable, option, request value, or function result reaching HTML output without a nearby escaping call.
Why It Matters
Unescaped output can become cross-site scripting when attackers control any part of the value being printed.
How to Fix
- Use `esc_html()` for plain text, `esc_attr()` for attributes, and `esc_url()` for URLs.
- Use `wp_kses()` or `wp_kses_post()` when limited HTML is intentionally allowed.
- Escape as late as possible, right before output, so the selected escaping function matches the final context.
References
Affected Plugins
| Rank | Plugin | Score | Errors | Warnings | Installs | Added | Updated | Top Issue |
|---|---|---|---|---|---|---|---|---|
| #5751 | blueimp lightbox | 75 | 19 | 2 | 1k+ | Output is not escaped | ||
| #5752 | Bulk Comments Management | 75 | 6 | 25 | 700 | Direct Query | ||
| #5753 | Canvas Image Resize | 75 | 19 | 1 | 1k+ | Output is not escaped | ||
| #5754 | chat-me-now | 75 | 15 | 5 | 4k+ | Output is not escaped | ||
| #5755 | Cognito Forms | 75 | 13 | 4 | 2k+ | wp function not compatible with requires wp | ||
| #5756 | Colored Admin Post List | 75 | 8 | 0 | 500 | Heredoc Output Not Escaped | ||
| #5757 | Conditional Logic Emails, Fields, Redirect for Elementor Forms | 75 | 312 | 31 | 2k+ | wp function not compatible with requires wp | ||
| #5758 | Custom field finder | 75 | 9 | 3 | 2k+ | Output is not escaped | ||
| #5759 | Customize Twenty Seventeen | 75 | 33 | 19 | 2k+ | Text Domain Mismatch | ||
| #5760 | Customize Twenty Sixteen | 75 | 32 | 11 | 500 | Text Domain Mismatch | ||
| #5761 | Delay Redirects | 75 | 5 | 8 | 900 | Request data is not unslashed | ||
| #5762 | En Spam | 75 | 21 | 6 | 500 | wp function not compatible with requires wp | ||
| #5763 | Eventin Addons for Divi Builder | 75 | 6 | 17 | 800 | Nonce verification recommended | ||
| #5764 | FareHarbor for WordPress | 75 | 18 | 9 | 9k+ | Output is not escaped | ||
| #5765 | Force First and Last Name as Display Name | 75 | 5 | 12 | 2k+ | Missing nonce verification | ||
| #5766 | Gradient Button for Elementor | 75 | 16 | 4 | 2k+ | Output is not escaped | ||
| #5767 | Headers Security Advanced & HSTS WP | 75 | 20 | 10 | 90k+ | Missing Translators Comment | ||
| #5768 | Hum | 75 | 8 | 2 | 600 | wp function not compatible with requires wp | ||
| #5769 | List all URLs | 75 | 8 | 5 | 5k+ | Missing nonce verification | ||
| #5770 | Open Graph Protocol Framework | 75 | 17 | 12 | 3k+ | Missing direct file access protection | ||
| #5771 | Options Framework | 75 | 8 | 56 | 10k+ | Non-prefixed function | ||
| #5772 | PJ News Ticker | 75 | 13 | 14 | 3k+ | Output is not escaped | ||
| #5773 | Post Type Switcher | 75 | 3 | 18 | 200k+ | Direct Query | ||
| #5774 | Logos Reftagger | 75 | 12 | 15 | 10k+ | Deprecated parameter: add_option parameter 3 | ||
| #5775 | Services Section Block – Showcase Service Details in Grid or Columns | 75 | 9 | 19 | 2k+ | Non-prefixed namespace | ||
| #5776 | Simple SMTP by Maileroo | 75 | 40 | 8 | 700 | Text Domain Mismatch | ||
| #5777 | Styleguide – Custom Fonts and Colors | 75 | 59 | 25 | 2k+ | Missing direct file access protection | ||
| #5778 | Testimonial – Testimonial Slider and Showcase Plugin | 75 | 563 | 231 | 30k+ | Text Domain Mismatch | ||
| #5779 | True Lazy Analytics | 75 | 11 | 13 | 6k+ | Nonce verification recommended | ||
| #5780 | UK Address Postcode Validation | 75 | 68 | 33 | 700 | Non Singular String Literal Domain | ||
| #5781 | Ultimate Under Construction | 75 | 22 | 2 | 1k+ | Non Enqueued Script | ||
| #5782 | Wonder PDF Embed | 75 | 53 | 1 | 8k+ | badly named files | ||
| #5783 | Ukrposhta | 75 | 24 | 226 | 500 | Non-prefixed global variable | ||
| #5784 | Custom Product Tabs Lite for WooCommerce | 75 | 3 | 11 | 4k+ | Input is not validated | ||
| #5785 | Extra Product Sorting Options for WooCommerce | 75 | 10 | 16 | 10k+ | Text Domain Mismatch | ||
| #5786 | WP Change Custom Posts Slugs | 75 | 17 | 4 | 700 | Text Domain Mismatch | ||
| #5787 | WP Disables Updates | 75 | 19 | 7 | 800 | Text Domain Mismatch | ||
| #5788 | WP Hide Dashboard | 75 | 6 | 10 | 2k+ | trademarked term | ||
| #5789 | WPSSO WP Sitemaps XML with News, Image, and Video Sitemap | 75 | 60 | 24 | 400 | Missing Translators Comment | ||
| #5790 | 404 Simple Redirect | 76 | 19 | 4 | 1k+ | Text Domain Mismatch | ||
| #5791 | Advanced Custom Fields: Ninjaforms Add-on | 76 | 43 | 8 | 1k+ | Text Domain Mismatch | ||
| #5792 | Add Link to Copied Text | 76 | 33 | 6 | 1k+ | Text Domain Mismatch | ||
| #5793 | Advanced CSS Editor | 76 | 25 | 6 | 5k+ | Output is not escaped | ||
| #5794 | Advanced Image Gallery for Elementor – Grid, Carousel & Slideshow | 76 | 3 | 226 | 400 | Non-prefixed global variable | ||
| #5795 | Ajax Cart AutoUpdate for WooCommerce | 76 | 15 | 5 | 8k+ | Output is not escaped | ||
| #5796 | AMS Google Webmaster Tools | 76 | 10 | 3 | 400 | Output is not escaped | ||
| #5797 | Auction Nudge – Your eBay Listings | 76 | 18 | 6 | 1k+ | Missing direct file access protection | ||
| #5798 | Audience Analytics – by Quantcast | 76 | 17 | 3 | 1k+ | Text Domain Mismatch | ||
| #5799 | Cache External Scripts | 76 | 21 | 4 | 900 | Output is not escaped | ||
| #5800 | Certificate customizer for Tutor LMS | 76 | 16 | 3 | 1k+ | Output is not escaped |
