WordPress.Security.EscapeOutput.OutputNotEscaped
Output is not escaped
Dynamic data is printed to the page without an escaping function for the output context.
Why It Shows Up
WordPress Coding Standards detected a variable, option, request value, or function result reaching HTML output without a nearby escaping call.
Why It Matters
Unescaped output can become cross-site scripting when attackers control any part of the value being printed.
How to Fix
- Use `esc_html()` for plain text, `esc_attr()` for attributes, and `esc_url()` for URLs.
- Use `wp_kses()` or `wp_kses_post()` when limited HTML is intentionally allowed.
- Escape as late as possible, right before output, so the selected escaping function matches the final context.
References
Affected Plugins
| Rank | Plugin | Score | Errors | Warnings | Installs | Added | Updated | Top Issue |
|---|---|---|---|---|---|---|---|---|
| #6351 | LB Back To Top | 92 | 4 | 2 | 700 | Missing Version | ||
| #6352 | Blocks Kit – Gutenberg Blocks for Freelancers | 92 | 1 | 9 | 400 | Non-prefixed constant | ||
| #6353 | Canada Post Shipping For WooCommerce | 92 | 4 | 0 | 2k+ | Output is not escaped | ||
| #6354 | Confetti Fall Animation | 92 | 2 | 5 | 500 | Non-prefixed class | ||
| #6355 | Contact Form 7 Shortcode Enabler | 92 | 4 | 3 | 10k+ | trademarked term | ||
| #6356 | Control XML-RPC publishing | 92 | 7 | 0 | 400 | Text Domain Mismatch | ||
| #6357 | Disable Customizer | 92 | 3 | 1 | 400 | Output is not escaped | ||
| #6358 | Dark Mode for WP Dashboard | 92 | 3 | 3 | 2k+ | trademarked term | ||
| #6359 | Editor Block Outline | 92 | 2 | 5 | 1k+ | Not In Footer | ||
| #6360 | Email Blacklist For Elementor Forms | 92 | 7 | 5 | 1k+ | Text Domain Mismatch | ||
| #6361 | ERE Colors – Essential Real Estate Add-On | 92 | 4 | 1 | 1k+ | Missing direct file access protection | ||
| #6362 | FastBots | 92 | 3 | 2 | 1k+ | Non Enqueued Script | ||
| #6363 | Find And Replace Text | 92 | 4 | 2 | 400 | Missing direct file access protection | ||
| #6364 | Find Posts Using Attachment | 92 | 4 | 2 | 1k+ | Missing direct file access protection | ||
| #6365 | Gallery Block by Galleryberg: Lightbox with Tiles, Masonry, Square, & Justified Layouts | 92 | 1 | 42 | 2k+ | Non-prefixed global variable | ||
| #6366 | Grid Shortcodes | 92 | 3 | 2 | 2k+ | Missing Version | ||
| #6367 | Health Endpoint | 92 | 3 | 2 | 3k+ | Missing Arg Domain | ||
| #6368 | Hide Categories On Shop Page | 92 | 11 | 4 | 1k+ | Text Domain Mismatch | ||
| #6369 | hideShowPassword | 92 | 3 | 5 | 400 | trademarked term | ||
| #6370 | Hoot Import | 92 | 1 | 10 | 1k+ | Direct Query | ||
| #6371 | Lightweight Accordion | 92 | 2 | 3 | 10k+ | Non-prefixed function | ||
| #6372 | Lightweight Grid Columns | 92 | 4 | 2 | 10k+ | Missing Version | ||
| #6373 | Block for Apple Maps | 92 | 14 | 3 | 1k+ | Missing direct file access protection | ||
| #6374 | MB ImageChimp RSS Feed Enhancer | 92 | 6 | 0 | 700 | wp function not compatible with requires wp | ||
| #6375 | Yoga Schedule Momoyoga | 92 | 3 | 2 | 1k+ | Missing Version | ||
| #6376 | MyD Delivery Widgets | 92 | 5 | 1 | 500 | Missing Translators Comment | ||
| #6377 | PDF Thumbnails | 92 | 5 | 2 | 1k+ | Missing Arg Domain | ||
| #6378 | Pk Google Analytics | 92 | 3 | 1 | 400 | Output is not escaped | ||
| #6379 | Remove RSS Feed | 92 | 5 | 0 | 1k+ | Missing Arg Domain | ||
| #6380 | Site Closed | 92 | 5 | 0 | 400 | Missing direct file access protection | ||
| #6381 | Greeklish Slugs | 92 | 12 | 2 | 3k+ | Text Domain Mismatch | ||
| #6382 | Skyboot Portfolio Gallery for Elementor | 92 | 116 | 3 | 1k+ | Text Domain Mismatch | ||
| #6383 | Storefront Add Slider | 92 | 11 | 1 | 800 | Text Domain Mismatch | ||
| #6384 | Surbma | Divi Project Shortcodes | 92 | 5 | 2 | 400 | Text Domain Mismatch | ||
| #6385 | ThemeMiles Toolset | 92 | 12 | 2 | 500 | Text Domain Mismatch | ||
| #6386 | TP WooCommerce Product Gallery | 92 | 4 | 9 | 1k+ | Non-prefixed function | ||
| #6387 | Ultimate Fonts | 92 | 6 | 3 | 400 | Missing Arg Domain | ||
| #6388 | User Access Shortcodes | 92 | 3 | 1 | 1k+ | Missing direct file access protection | ||
| #6389 | Advanced Post Block – Display Your Posts Exactly How You Want | 93 | 1 | 3 | 10k+ | Output is not escaped | ||
| #6390 | Alt Text Tools | 93 | 1 | 4 | 800 | Non-prefixed class | ||
| #6391 | Section Builder with Backgrounds – Customize with Color, Gradient, Image and Parallax. | 93 | 2 | 7 | 1k+ | Non-prefixed global variable | ||
| #6392 | Bangla Web Fonts | 93 | 3 | 0 | 2k+ | Non Enqueued Stylesheet | ||
| #6393 | Chat Widget: Floating Customer Support Button for 30+ Channels, Supporting SMS, Calls, and Chat – Bit Assist | 93 | 2 | 4 | 10k+ | Missing Version | ||
| #6394 | Embed STL | 93 | 5 | 1 | 400 | Missing Arg Domain | ||
| #6395 | Kortez Toolset | 93 | 3 | 2 | 1k+ | Missing Translators Comment | ||
| #6396 | Lead Forensics | 93 | 1 | 5 | 5k+ | Non-prefixed hook name | ||
| #6397 | LitCommerce: Multi-channel Selling Tool For WooCommerce | 93 | 3 | 3 | 2k+ | Missing direct file access protection | ||
| #6398 | Pdf Embed | 93 | 4 | 4 | 10k+ | Non-prefixed global variable | ||
| #6399 | The Simplest Favicon | 93 | 3 | 0 | 700 | Missing direct file access protection | ||
| #6400 | Social Share Block – Help Visitors Spread Your Content Everywhere | 94 | 2 | 1 | 2k+ | Discouraged text-domain loading |
