WordPress.Security.EscapeOutput.OutputNotEscaped
Output is not escaped
Dynamic data is printed to the page without an escaping function for the output context.
Why It Shows Up
WordPress Coding Standards detected a variable, option, request value, or function result reaching HTML output without a nearby escaping call.
Why It Matters
Unescaped output can become cross-site scripting when attackers control any part of the value being printed.
How to Fix
- Use `esc_html()` for plain text, `esc_attr()` for attributes, and `esc_url()` for URLs.
- Use `wp_kses()` or `wp_kses_post()` when limited HTML is intentionally allowed.
- Escape as late as possible, right before output, so the selected escaping function matches the final context.
References
Affected Plugins
| Rank | Plugin | Score | Errors | Warnings | Installs | Added | Updated | Top Issue |
|---|---|---|---|---|---|---|---|---|
| #6251 | WebPlus Gateway for LiqPay on WooCommerce | 87 | 45 | 5 | 1k+ | wp function not compatible with requires wp | ||
| #6252 | Wider Gravity Forms Stop Entries | 87 | 22 | 0 | 600 | Text Domain Mismatch | ||
| #6253 | Friendly User Agent for WooCommerce | 87 | 6 | 2 | 400 | Output is not escaped | ||
| #6254 | WP CountUP JS | 87 | 3 | 3 | 1k+ | trademarked term | ||
| #6255 | Advanced Sitemap Generator | 88 | 5 | 5 | 400 | Discouraged PHP function | ||
| #6256 | Ample Themes Demo Importer | 88 | 135 | 13 | 600 | Text Domain Mismatch | ||
| #6257 | Color Mobile Browser Address Bar | 88 | 5 | 0 | 2k+ | Output is not escaped | ||
| #6258 | Conditional Add to Cart for WooCommerce | 88 | 2 | 104 | 600 | Non-prefixed global variable | ||
| #6259 | Serious Slider | 88 | 7 | 9 | 20k+ | Non-prefixed global variable | ||
| #6260 | Custom CSS for Elementor | 88 | 4 | 1 | 5k+ | Output is not escaped | ||
| #6261 | Custom Header Footer Scripts for Customizer | 88 | 6 | 5 | 2k+ | Non-prefixed function | ||
| #6262 | Dynamic Animations for Elementor | 88 | 77 | 17 | 1k+ | Non Singular String Literal Domain | ||
| #6263 | AH Google Analytics Code | 88 | 6 | 2 | 500 | Output is not escaped | ||
| #6264 | Fancy Admin UI | 88 | 10 | 3 | 1k+ | Missing Version | ||
| #6265 | Fourteen Colors | 88 | 16 | 1 | 8k+ | Text Domain Mismatch | ||
| #6266 | G-Forms hCaptcha | 88 | 7 | 5 | 3k+ | Missing direct file access protection | ||
| #6267 | GutenTOC – Advanced Table of Contents | 88 | 5 | 10 | 700 | Missing Version | ||
| #6268 | HivePress Paid Listings | 88 | 5 | 1 | 5k+ | Output is not escaped | ||
| #6269 | Lightbox with PhotoSwipe | 88 | 1 | 24 | 20k+ | Non-prefixed global variable | ||
| #6270 | Minimal Coming Soon – Coming Soon Page | 88 | 7 | 143 | 100k+ | Non-prefixed global variable | ||
| #6271 | Modular Custom CSS | 88 | 7 | 1 | 400 | Output is not escaped | ||
| #6272 | Rel Nofollow | 88 | 9 | 1 | 700 | Missing Arg Domain | ||
| #6273 | Related Posts Flatsome | 88 | 24 | 4 | 10k+ | Text Domain Mismatch | ||
| #6274 | Repeat Order for WooCommerce | 88 | 19 | 9 | 3k+ | Text Domain Mismatch | ||
| #6275 | WP REST API Meta Endpoints | 88 | 50 | 3 | 1k+ | Missing Arg Domain | ||
| #6276 | SJ Cornerstone Addon | 88 | 57 | 0 | 400 | Text Domain Mismatch | ||
| #6277 | Table Sorter | 88 | 4 | 5 | 6k+ | Not In Footer | ||
| #6278 | Text Unfold For Elementor | 88 | 122 | 0 | 3k+ | Text Domain Mismatch | ||
| #6279 | WC Hide Shipping Methods | 88 | 5 | 5 | 20k+ | trademarked term | ||
| #6280 | Draft – Tailwind CSS for WordPress. | 88 | 10 | 5 | 600 | Text Domain Mismatch | ||
| #6281 | WooCommerce Shortcodes | 88 | 5 | 7 | 9k+ | trademarked term | ||
| #6282 | استایل مدیریت وردپرس | 88 | 5 | 4 | 2k+ | Not In Footer | ||
| #6283 | WP Insert Code | 88 | 6 | 4 | 1k+ | trademarked term | ||
| #6284 | WP jQuery Plus | 88 | 7 | 5 | 900 | trademarked term | ||
| #6285 | WPCasa Contact Form 7 | 88 | 4 | 5 | 500 | Output is not escaped | ||
| #6286 | WPJM Extra Fields | 88 | 5 | 5 | 2k+ | trademarked term | ||
| #6287 | Animate on Scroll | 89 | 2 | 4 | 4k+ | Input is not validated | ||
| #6288 | atec Cache Info | 89 | 24 | 2 | 1k+ | wp function not compatible with requires wp | ||
| #6289 | Blog Filter – Post Grid Filter by Category or Tag | 89 | 1 | 5 | 7k+ | Nonce verification recommended | ||
| #6290 | Bottom Admin Toolbar | 89 | 5 | 1 | 1k+ | Output is not escaped | ||
| #6291 | Breadcrumb Trail | 89 | 6 | 4 | 10k+ | Non-prefixed hook name | ||
| #6292 | CJdropshipping | 89 | 4 | 2 | 3k+ | Missing Arg Domain | ||
| #6293 | Clarity – Ad blocker for WordPress | 89 | 5 | 19 | 2k+ | Non-prefixed hook name | ||
| #6294 | Clear cache for Timber | 89 | 20 | 1 | 500 | wp function not compatible with requires wp | ||
| #6295 | Content Update Scheduler | 89 | 2 | 17 | 2k+ | Non-prefixed global variable | ||
| #6296 | CSS | 89 | 10 | 1 | 500 | Missing Arg Domain | ||
| #6297 | EDD Auto Register | 89 | 13 | 7 | 900 | Missing Translators Comment | ||
| #6298 | elegro Crypto Payment | 89 | 5 | 9 | 20k+ | Missing Version | ||
| #6299 | Fancy Elementor Flipbox | 89 | 4 | 3 | 5k+ | Output is not escaped | ||
| #6300 | Cool Flipbox – Shortcode & Gutenberg Block | 89 | 29 | 10 | 5k+ | wp function not compatible with requires wp |
