Output is not escaped

Why It Shows Up

WordPress Coding Standards detected a variable, option, request value, or function result reaching HTML output without a nearby escaping call.

Why It Matters

Unescaped output can become cross-site scripting when attackers control any part of the value being printed.

How to Fix

• Use `esc_html()` for plain text, `esc_attr()` for attributes, and `esc_url()` for URLs.
• Use `wp_kses()` or `wp_kses_post()` when limited HTML is intentionally allowed.
• Escape as late as possible, right before output, so the selected escaping function matches the final context.

References