PluginScore

WordPress.Security.EscapeOutput.OutputNotEscaped

Output is not escaped

Dynamic data is printed to the page without an escaping function for the output context.

critical weight

Why It Shows Up

WordPress Coding Standards detected a variable, option, request value, or function result reaching HTML output without a nearby escaping call.

Why It Matters

Unescaped output can become cross-site scripting when attackers control any part of the value being printed.

How to Fix

  • Use `esc_html()` for plain text, `esc_attr()` for attributes, and `esc_url()` for URLs.
  • Use `wp_kses()` or `wp_kses_post()` when limited HTML is intentionally allowed.
  • Escape as late as possible, right before output, so the selected escaping function matches the final context.

References

WordPress escaping functions

Affected Plugins

RankPluginScoreErrorsWarningsInstallsAddedUpdatedTop Issue
#351Content Egg – Affiliate Product Importer & Price Comparison231,2451,27510k+Non-prefixed global variable
#352Content Views – Post Grid & Filter, Recent Posts, Category Posts … (Shortcode, Gutenberg Blocks, and Widgets for Elementor)23306587100k+Dynamic hook name
#353Contest Gallery – Upload & Vote Photos, Media, Sell with PayPal & Stripe239,31526,6441k+Non-prefixed global variable
#354Free Theme Builder for Elementor – CRT Addons (Header, Footer, Archive, WooCommerce & 50+ Widgets)237912,331400Non-prefixed global variable
#355Currency Exchange for WooCommerce23692505500Output is not escaped
#356CWW Companion233072231k+Output is not escaped
#357Auto Post Cleaner237151,3781k+Non-prefixed global variable
#358Disable Bloat for WordPress & WooCommerce238631,32510k+Non-prefixed global variable
#359DK PDF – WordPress PDF Generator237443353k+Exception output is not escaped
#360Dokan: AI Powered WooCommerce Multivendor Marketplace Solution – Build Your Own Amazon, eBay, Etsy2317082140k+Non-prefixed global variable
#361Easy Age Verify231,1382,6311k+Non-prefixed global variable
#362Easy Digital Downloads – eCommerce Payments and Subscriptions made easy233,72310,28340k+Non-prefixed namespace
#363Marijuana Age Verify231,1542,6301k+Non-prefixed global variable
#364EazyDocs – AI Powered Knowledge Base, Wiki, Documentation & FAQ Builder233551,5412k+Non-prefixed global variable
#365Ecwid by Lightspeed Ecommerce Shopping Cart2333930720k+Missing direct file access protection
#366ElementsReady Addons for Elementor232316663k+Non-prefixed global variable
#367Error Log Monitor236941,41420k+Non-prefixed global variable
#368Essential Real Estate235295,0608k+Non-prefixed global variable
#369EventON – Events Calendar232,5851,0216k+Text Domain Mismatch
#370Events Addon for Elementor237791,3397k+Non-prefixed global variable
#371Everest Forms – Contact Form, Payment Form, Quiz, Survey & Custom Form Builder with AI233951,34290k+Non-prefixed global variable
#372Spreadsheet Price Changer for WooCommerce and WP E-commerce – Light23386999400Non-prefixed global variable
#373Ezoic2343251610k+Output is not escaped
#374Fastcache by Host.it231,327203800Text Domain Mismatch
#375Featured Images in RSS for Mailchimp & More237801,29920k+Non-prefixed global variable
#376Feed Them Social – Social Media Feeds, Video, and Photo Galleries2356353520k+Output is not escaped
#377Filr – Secure document library237751,317700Non-prefixed global variable
#378Finpose – Accounting for WooCommerce231,6491,307400Non-prefixed global variable
#379Image Photo Gallery Final Tiles Grid235781,50220k+Non-prefixed global variable
#380Five-Star Ratings Shortcode236041,317600Non-prefixed global variable
#381Flexmls® IDX Plugin231,2689571k+Output is not escaped
#382Form Maker by 10Web – Mobile-Friendly Drag & Drop Contact Form Builder234,7461,27930k+Non Singular String Literal Domain
#383Freshdesk (official)23194386800Non-prefixed function
#384Front End PM239782,2645k+Non-prefixed global variable
#385Tracking and Consent Manager – WP Full Picture231,2803,2233k+Non-prefixed global variable
#386Futurio Extra2378720520k+Text Domain Mismatch
#387FV Flowplayer Video Player231,3111,45420k+Output is not escaped
#388GAinWP Google Analytics Integration for WordPress235251768k+Output is not escaped
#389GamiPress – Gamification plugin to reward points, achievements, badges & ranks in WordPress233,6212,74410k+Output is not escaped
#390The GDPR Framework By Data443231,28751710k+Short PHP open tag found
#391Anti-Malware Security and Brute-Force Firewall23543965100k+Output is not escaped
#392Gmedia Photo Gallery233501,1217k+Non-prefixed global variable
#393Groovy Menu Plugin (Free)231,7292834k+Text Domain Mismatch
#394Groundhogg — CRM, Newsletters, and Marketing Automation231369212k+Non-prefixed global variable
#395Gutenberg23605327300k+Missing direct file access protection
#396Interactive Content – H5P2356538040k+Non Singular String Literal Domain
#397Happy Addons for Elementor23573444400k+Output is not escaped
#398Houzez Property Feed231,4641,5851k+Text Domain Mismatch
#399Hunk Companion232,5476876k+Text Domain Mismatch
#400Ibtana – Ecommerce Product Addons231,5471,7186k+Non Singular String Literal Domain