PluginScore

WordPress.Security.EscapeOutput.OutputNotEscaped

Output is not escaped

Dynamic data is printed to the page without an escaping function for the output context.

critical weight

Why It Shows Up

WordPress Coding Standards detected a variable, option, request value, or function result reaching HTML output without a nearby escaping call.

Why It Matters

Unescaped output can become cross-site scripting when attackers control any part of the value being printed.

How to Fix

  • Use `esc_html()` for plain text, `esc_attr()` for attributes, and `esc_url()` for URLs.
  • Use `wp_kses()` or `wp_kses_post()` when limited HTML is intentionally allowed.
  • Escape as late as possible, right before output, so the selected escaping function matches the final context.

References

WordPress escaping functions

Affected Plugins

RankPluginScoreErrorsWarningsInstallsAddedUpdatedTop Issue
#901Online Scheduling and Appointment Booking System – Bookly251,08888860k+SQL query is not prepared
#902Breeze Cache25218800400k+Non-prefixed global variable
#903Broken Link Checker25727600500k+Output is not escaped
#904BuddyPress Docs252844217k+Nonce verification recommended
#905Bulk Edit and Create User Profiles – WP Sheet Editor259951,0011k+Text Domain Mismatch
#906PublishPress Capabilities – User Role Editor, Access Permissions, User Capabilities, Admin Menus253621,586100k+Non-prefixed global variable
#907SilentShield – Captcha & Anti-Spam for WordPress (CF7, WPForms, Elementor, WooCommerce)2523521410k+Database parameter is not escaped
#908GSheetConnector for CF7 – Connect Contact Form 7 to Google Sheets and Send Form Submissions in Real Time256141,43140k+Non-prefixed global variable
#909CheckoutWC Lite – Conversion optimized WooCommerce checkout251,4168543k+Text Domain Mismatch
#910CheckView – Form & Checkout Testing25663371k+Direct Query
#911HIPAA FORMS25414416800Request data is not unslashed
#912Admin Columns25613995100k+Non-prefixed namespace
#913Colissimo shipping methods for WooCommerce251,75555710k+Text Domain Mismatch
#914Website Builder by SeedProd — Theme Builder, Landing Page Builder, Coming Soon Page, Maintenance Mode25991,040700k+Non-prefixed global variable
#915Disable Comments & Delete All Comments255031859k+Output is not escaped
#916Coinbase Business Gateway for WooCommerce255691,317800Non-prefixed global variable
#917Conditional Payment Methods for WooCommerce255481,3981k+Non-prefixed global variable
#918Contact Form DB Divi255331,2993k+Non-prefixed global variable
#919Contact Form Email254098989k+Non-prefixed global variable
#920Coupon Creator256984121k+Output is not escaped
#921CP Contact Form with PayPal25466936800Unsafe printing function
#922Cryptocurrency Payment Gateway251,963589400Text Domain Mismatch
#923CSS & JavaScript Toolbox2515561710k+Non-prefixed class
#924Smash Balloon Social Post Feed – Simple Social Feeds for WordPress25554982200k+Output is not escaped
#925DecaLog259432361k+Exception output is not escaped
#926Demo Importer Plus255823910k+Non-prefixed hook name
#927Disable Admin Notices – Hide Dashboard Notifications25465195100k+Output is not escaped
#928Docket Cache – Object Cache Accelerator2533348120k+Output is not escaped
#929ELEX WooCommerce Dynamic Pricing and Discounts25478748800Text Domain Mismatch
#930Show Eventbrite Events – Event Feed for Eventbrite255951,525800Non-prefixed global variable
#931Event Genius – Event Management, Events Calendar, Registration, and RSVP251811,579500Non-prefixed global variable
#932Events Made Easy255216,3241k+Non-prefixed function
#933F4 Post Tree255361,332500Non-prefixed global variable
#934胖鼠采集(Fat Rat Collect)25630190900Missing Arg Domain
#935FlatPM – Ad Manager, AdSense and Custom Code253,01755710k+Text Domain Mismatch
#936FluentCart A New Era of eCommerce – Faster, Lighter, and Simpler253194547k+Non-prefixed global variable
#937Fluid Checkout for WooCommerce – Lite2537084120k+Non-prefixed hook name
#938Lightbox & Modal Popup WordPress Plugin – FooBox256101,365100k+Non-prefixed global variable
#939Photo Gallery by FooGallery : Responsive Image Gallery, Masonry Gallery & Carousel258761,798100k+Non-prefixed global variable
#940AnWP Football Leagues253,5981,955800Text Domain Mismatch
#941Form Vibes – Save Contact Form 7 & Elementor Form Entries to Database257161,50910k+Non-prefixed global variable
#942WP Fast Total Search – The Power of Indexed Search252092911k+Non-prefixed global variable
#943FunnelKit – Funnel Builder for WooCommerce Checkout253,1642,62430k+Text Domain Mismatch
#944Gallery Images Ape255883411k+Output is not escaped
#945Photo Gallery by Ays – Responsive Image Gallery254668201k+Output is not escaped
#946Portfolio Gallery – Responsive Image Gallery251082,4631k+Non-prefixed global variable
#947GD Rating System251,5111,0431k+Output is not escaped
#948GD Security Headers254075211k+Output is not escaped
#949GeekyBot — AI Copilot, Chatbot, WooCommerce Lead Gen & Zero-Prompt Content25888636k+Non-prefixed global variable
#950Genesis Club Lite25513317900Output is not escaped