WordPress.Security.EscapeOutput.OutputNotEscaped
Output is not escaped
Dynamic data is printed to the page without an escaping function for the output context.
Why It Shows Up
WordPress Coding Standards detected a variable, option, request value, or function result reaching HTML output without a nearby escaping call.
Why It Matters
Unescaped output can become cross-site scripting when attackers control any part of the value being printed.
How to Fix
- Use `esc_html()` for plain text, `esc_attr()` for attributes, and `esc_url()` for URLs.
- Use `wp_kses()` or `wp_kses_post()` when limited HTML is intentionally allowed.
- Escape as late as possible, right before output, so the selected escaping function matches the final context.
References
Affected Plugins
| Rank | Plugin | Score | Errors | Warnings | Installs | Added | Updated | Top Issue |
|---|---|---|---|---|---|---|---|---|
| #3101 | Chatbot for WordPress by Collect.chat ⚡️ | 38 | 58 | 36 | 6k+ | Unsafe printing function | ||
| #3102 | Colorlib 404 Customizer | 38 | 65 | 15 | 5k+ | Missing direct file access protection | ||
| #3103 | Country Code Selector | 38 | 91 | 20 | 1k+ | Unsafe printing function | ||
| #3104 | country-redirect | 38 | 58 | 19 | 400 | Text Domain Mismatch | ||
| #3105 | Crop-Thumbnails | 38 | 33 | 27 | 40k+ | Missing direct file access protection | ||
| #3106 | CRUDLab Disable Comments | 38 | 20 | 54 | 700 | Missing nonce verification | ||
| #3107 | One page checkout and layouts for woocommerce | 38 | 83 | 52 | 3k+ | Non-prefixed global variable | ||
| #3108 | Custom Menu Wizard Widget | 38 | 326 | 30 | 2k+ | Output is not escaped | ||
| #3109 | WP Page Templates | 38 | 92 | 28 | 400 | Non Singular String Literal Domain | ||
| #3110 | Custom post type templates for Elementor | 38 | 289 | 33 | 700 | Text Domain Mismatch | ||
| #3111 | Customize Posts | 38 | 31 | 77 | 1k+ | Non-prefixed hook name | ||
| #3112 | Login Page Customizer – Customize Login Screen & Branding | 38 | 36 | 172 | 1k+ | Non-prefixed function | ||
| #3113 | Darkify – Dark Mode & Night Mode for Website & Admin (Dark Theme Included) | 38 | 38 | 183 | 600 | Non-prefixed global variable | ||
| #3114 | Datafeedr Comparison Sets | 38 | 450 | 53 | 3k+ | Output is not escaped | ||
| #3115 | Datafeedr WooCommerce Importer | 38 | 112 | 56 | 5k+ | Text Domain Mismatch | ||
| #3116 | Availability Datepicker – Booking Calendar for Contact Form 7 – Input WP | 38 | 344 | 30 | 20k+ | Text Domain Mismatch | ||
| #3117 | Decent Comments | 38 | 93 | 28 | 2k+ | Output is not escaped | ||
| #3118 | Responsive Pricing Table | 38 | 309 | 105 | 10k+ | Non Singular String Literal Domain | ||
| #3119 | Product Badge, Label, Countdown Timer for WooCommerce – Sale Booster | 38 | 37 | 102 | 5k+ | Interpolated SQL is not prepared | ||
| #3120 | Easy WP Cleaner | 38 | 58 | 124 | 2k+ | Non-prefixed global variable | ||
| #3121 | Easy Yandex Metrica | 38 | 97 | 48 | 900 | Output is not escaped | ||
| #3122 | Elemailer Lite – Elementor email template & campaign builder | 38 | 44 | 50 | 5k+ | Output is not escaped | ||
| #3123 | Email Encoder – Protect Email Addresses and Phone Numbers | 38 | 9 | 150 | 90k+ | Non-prefixed global variable | ||
| #3124 | Erident Custom Login and Dashboard | 38 | 122 | 28 | 8k+ | Unsafe printing function | ||
| #3125 | EU Cookie Law Compliance | 38 | 151 | 22 | 2k+ | Non Singular String Literal Domain | ||
| #3126 | Export to Blogger | 38 | 47 | 117 | 900 | Non-prefixed global variable | ||
| #3127 | Export User Data | 38 | 187 | 62 | 6k+ | Text Domain Mismatch | ||
| #3128 | Buttonizer – Social Media Share Buttons, Social Icons, & Social Feeds | 38 | 167 | 82 | 40k+ | Output is not escaped | ||
| #3129 | Social Photo Fetcher | 38 | 151 | 43 | 1k+ | Output is not escaped | ||
| #3130 | Social Shop for WooCommerce | 38 | 51 | 24 | 800 | Output is not escaped | ||
| #3131 | Responsive WordPress Slider – HG Slider | 38 | 67 | 75 | 7k+ | Missing nonce verification | ||
| #3132 | Flexy Breadcrumb | 38 | 241 | 13 | 20k+ | Output is not escaped | ||
| #3133 | Foyer – Digital Signage for WordPress | 38 | 148 | 191 | 1k+ | Non-prefixed global variable | ||
| #3134 | Front-end Editor | 38 | 78 | 62 | 500 | Output is not escaped | ||
| #3135 | Gecka Submenu | 38 | 326 | 36 | 3k+ | Output is not escaped | ||
| #3136 | GiveWP Donation Widgets for Elementor | 38 | 483 | 13 | 7k+ | Text Domain Mismatch | ||
| #3137 | Goal Tracker – Custom Event Tracking for GA4 | 38 | 541 | 25 | 2k+ | Output is not escaped | ||
| #3138 | GoDaddy Payments for WooCommerce | 38 | 58 | 65 | 2k+ | Output is not escaped | ||
| #3139 | GoodBarber | 38 | 38 | 73 | 1k+ | Nonce verification recommended | ||
| #3140 | GoUrl WooCommerce – Bitcoin Altcoin Payment Gateway Addon | 38 | 279 | 24 | 600 | Non Singular String Literal Domain | ||
| #3141 | Great Caroussel | 38 | 60 | 131 | 500 | SQL query is not prepared | ||
| #3142 | Greek Multi Tool – Greeklish Slugs, Permalinks & Transliteration | 38 | 160 | 82 | 1k+ | Unsafe printing function | ||
| #3143 | HashThemes Demo Importer | 38 | 71 | 44 | 6k+ | Output is not escaped | ||
| #3144 | CAOS | Host Google Analytics Locally | 38 | 124 | 44 | 10k+ | Output is not escaped | ||
| #3145 | WP Team – WordPress Team Member Plugin | 38 | 537 | 36 | 500 | Text Domain Mismatch | ||
| #3146 | Icegram Mailer – Reliable Email Deliverability, No-code SMTP Replacement & Email logs | 38 | 36 | 106 | 2k+ | Non-prefixed global variable | ||
| #3147 | Illdy Companion | 38 | 187 | 23 | 6k+ | Output is not escaped | ||
| #3148 | ThumbPress – Compress Images, Manage Thumbnails, Detect Image Issues, WebP/AVIF, Lazy Loading, Hotlinking & More | 38 | 20 | 89 | 30k+ | Direct Query | ||
| #3149 | imoje | 38 | 62 | 160 | 2k+ | Nonce verification recommended | ||
| #3150 | Import to Photo Gallery from NextGen gallery | 38 | 80 | 83 | 400 | Direct Query |
