WordPress.Security.EscapeOutput.OutputNotEscaped
Output is not escaped
Dynamic data is printed to the page without an escaping function for the output context.
Why It Shows Up
WordPress Coding Standards detected a variable, option, request value, or function result reaching HTML output without a nearby escaping call.
Why It Matters
Unescaped output can become cross-site scripting when attackers control any part of the value being printed.
How to Fix
- Use `esc_html()` for plain text, `esc_attr()` for attributes, and `esc_url()` for URLs.
- Use `wp_kses()` or `wp_kses_post()` when limited HTML is intentionally allowed.
- Escape as late as possible, right before output, so the selected escaping function matches the final context.
References
Affected Plugins
| Rank | Plugin | Score | Errors | Warnings | Installs | Added | Updated | Top Issue |
|---|---|---|---|---|---|---|---|---|
| #6301 | Add Follow Button For Pintrest | 91 | 21 | 5 | 400 | Non Singular String Literal Domain | ||
| #6302 | Admin Dashboard Last Edits | 91 | 5 | 0 | 900 | Missing Translators Comment | ||
| #6303 | Advanced Posts/Page | 91 | 16 | 2 | 3k+ | Text Domain Mismatch | ||
| #6304 | Book Review Block | 91 | 11 | 2 | 1k+ | block api version too low | ||
| #6305 | Caddy – WooCommerce Side Cart & Free Shipping Bar | 91 | 2 | 2 | 3k+ | Output is not escaped | ||
| #6306 | Change Empty Trash Time | 91 | 5 | 3 | 1k+ | Missing direct file access protection | ||
| #6307 | Childify Me | 91 | 9 | 1 | 8k+ | wp function not compatible with requires wp | ||
| #6308 | Clever Fox | 91 | 16 | 1 | 30k+ | wp function not compatible with requires wp | ||
| #6309 | Connector GravityForms and MailerLite | 91 | 8 | 2 | 2k+ | Missing Translators Comment | ||
| #6310 | CTA Button Styler | 91 | 3 | 39 | 400 | Non-prefixed global variable | ||
| #6311 | Custom iFrame – Embed PDFs, Videos, and External Content in WordPress (Elementor & Gutenberg) | 91 | 13 | 5 | 4k+ | wp function not compatible with requires wp | ||
| #6312 | Di Blocks – Awesome WordPress Blocks for Gutenberg Editor | 91 | 7 | 3 | 1k+ | Missing direct file access protection | ||
| #6313 | Nút Bấm Liên Hệ Dibrother | 91 | 5 | 2 | 1k+ | Missing Arg Domain | ||
| #6314 | Easy Digital Downloads Free Link | 91 | 11 | 3 | 1k+ | Short PHP open tag found | ||
| #6315 | Easy Logo Link Change | 91 | 6 | 1 | 1k+ | Deprecated function: screen_icon | ||
| #6316 | Eazy Login Logo | 91 | 4 | 2 | 400 | Missing direct file access protection | ||
| #6317 | ERE Similar Properties – Essential Real Estate Add-On | 91 | 4 | 3 | 1k+ | Missing direct file access protection | ||
| #6318 | FAQ Schema for Elementor | 91 | 11 | 3 | 800 | Text Domain Mismatch | ||
| #6319 | FT Password Protect Children Pages | 91 | 8 | 1 | 400 | Missing Arg Domain | ||
| #6320 | Gravity Forms Confirmation Page List | 91 | 6 | 3 | 400 | Missing direct file access protection | ||
| #6321 | Gravity Forms Placeholder Add-On | 91 | 5 | 4 | 1k+ | trademarked term | ||
| #6322 | Gutentools | 91 | 17 | 10 | 5k+ | Missing direct file access protection | ||
| #6323 | Hot Random Image | 91 | 24 | 1 | 2k+ | Text Domain Mismatch | ||
| #6324 | Lazy Load Elementor Background Images | 91 | 5 | 6 | 1k+ | Non-prefixed function | ||
| #6325 | Limit Revisions | 91 | 7 | 1 | 1k+ | Missing Arg Domain | ||
| #6326 | Loop Post Navigation Links | 91 | 7 | 5 | 500 | Missing Arg Domain | ||
| #6327 | MAS Static Content | 91 | 3 | 7 | 10k+ | Non-prefixed hook name | ||
| #6328 | matchHeight | 91 | 6 | 2 | 2k+ | Non-prefixed global variable | ||
| #6329 | Modular Custom CSS | 91 | 2 | 1 | 400 | Output is not escaped | ||
| #6330 | Parent Category Toggler | 91 | 6 | 0 | 10k+ | Missing direct file access protection | ||
| #6331 | Preload Featured Images | 91 | 2 | 2 | 1k+ | Output is not escaped | ||
| #6332 | Replace Google Fonts with Bunny Fonts | 91 | 6 | 1 | 900 | wp function not compatible with requires wp | ||
| #6333 | Restricted Site Access | 91 | 14 | 11 | 10k+ | Missing Arg Domain | ||
| #6334 | Search and Replace for Block Editor | 91 | 2 | 1 | 600 | Output is not escaped | ||
| #6335 | Sensei LMS Post to Course Creator | 91 | 6 | 7 | 1k+ | Missing Translators Comment | ||
| #6336 | Serbian Addons for WooCommerce | 91 | 34 | 13 | 500 | Text Domain Mismatch | ||
| #6337 | Simple Google Analytics Tracking | 91 | 6 | 2 | 1k+ | Missing direct file access protection | ||
| #6338 | Simple Membership Form Shortcode | 91 | 7 | 1 | 2k+ | Missing direct file access protection | ||
| #6339 | Simple WP Maintenance Mode | 91 | 6 | 4 | 2k+ | trademarked term | ||
| #6340 | Simply Show IDs | 91 | 5 | 1 | 3k+ | Missing direct file access protection | ||
| #6341 | Sticky Banner | 91 | 2 | 17 | 700 | Non-prefixed global variable | ||
| #6342 | Storefront Footer Bar | 91 | 6 | 2 | 3k+ | Missing Arg Domain | ||
| #6343 | Timeline Express HTML Excerpts Add-on | 91 | 9 | 6 | 1k+ | Text Domain Mismatch | ||
| #6344 | Validated | 91 | 7 | 3 | 600 | Missing direct file access protection | ||
| #6345 | WooCommerce New Product Badge | 91 | 8 | 8 | 800 | Text Domain Mismatch | ||
| #6346 | WPS HTML Blocks | 91 | 23 | 4 | 1k+ | Text Domain Mismatch | ||
| #6347 | Yivic Easy Live Chat | 91 | 22 | 8 | 1k+ | Non Singular String Literal Domain | ||
| #6348 | Add Code To Head | 92 | 2 | 8 | 3k+ | Non-prefixed global variable | ||
| #6349 | Table Field Add-on for ACF and SCF | 92 | 9 | 3 | 50k+ | Text Domain Mismatch | ||
| #6350 | Blazeo | 92 | 4 | 5 | 400 | Missing Version |
