WordPress.Security.EscapeOutput.OutputNotEscaped
Output is not escaped
Dynamic data is printed to the page without an escaping function for the output context.
Why It Shows Up
WordPress Coding Standards detected a variable, option, request value, or function result reaching HTML output without a nearby escaping call.
Why It Matters
Unescaped output can become cross-site scripting when attackers control any part of the value being printed.
How to Fix
- Use `esc_html()` for plain text, `esc_attr()` for attributes, and `esc_url()` for URLs.
- Use `wp_kses()` or `wp_kses_post()` when limited HTML is intentionally allowed.
- Escape as late as possible, right before output, so the selected escaping function matches the final context.
References
Affected Plugins
| Rank | Plugin | Score | Errors | Warnings | Installs | Added | Updated | Top Issue |
|---|---|---|---|---|---|---|---|---|
| #4301 | Per User Prompt for Google Authenticator | 43 | 8 | 52 | 400 | Nonce verification recommended | ||
| #4302 | Event Tracking for Gravity Forms | 43 | 34 | 25 | 20k+ | rand mt rand | ||
| #4303 | Insert Blocks Before or After Posts Content | 43 | 42 | 15 | 1k+ | Output is not escaped | ||
| #4304 | jQuery UI Widgets | 43 | 131 | 5 | 1k+ | Unsafe printing function | ||
| #4305 | Linker – URL shortener & track outbound link clicks | 43 | 17 | 17 | 2k+ | Output is not escaped | ||
| #4306 | Logo Slider WP – Responsive Logo Carousel, Logo Gallery & Logo Showcase | 43 | 22 | 255 | 10k+ | Non-prefixed global variable | ||
| #4307 | Make Tables Responsive | 43 | 31 | 102 | 6k+ | Input is not validated | ||
| #4308 | MembershipWorks Login Connector | 43 | 28 | 81 | 700 | Request data is not unslashed | ||
| #4309 | Lightbox | 43 | 29 | 10 | 700 | Unsafe printing function | ||
| #4310 | Page Transition | 43 | 39 | 30 | 700 | Output is not escaped | ||
| #4311 | PE Panels | 43 | 181 | 4 | 500 | Output is not escaped | ||
| #4312 | Post Carousel Slider for Elementor | 43 | 133 | 23 | 3k+ | Text Domain Mismatch | ||
| #4313 | Post title marquee scroll | 43 | 43 | 25 | 1k+ | Output is not escaped | ||
| #4314 | Pro Categories Widget | 43 | 59 | 9 | 800 | Output is not escaped | ||
| #4315 | Purchase Orders for WooCommerce | 43 | 117 | 74 | 1k+ | Text Domain Mismatch | ||
| #4316 | Qodax Checkout Manager – Checkout Field Editor for WooCommerce | 43 | 17 | 27 | 400 | Interpolated SQL is not prepared | ||
| #4317 | reCAPTCHA for MW WP Form | 43 | 37 | 14 | 30k+ | Non Singular String Literal Domain | ||
| #4318 | Redirect List | 43 | 34 | 22 | 1k+ | Output is not escaped | ||
| #4319 | Reoon Email Verifier | 43 | 22 | 38 | 600 | Missing nonce verification | ||
| #4320 | Rut Chileno con Validación para WooCommerce | 43 | 35 | 16 | 1k+ | Text Domain Mismatch | ||
| #4321 | Secure Passkeys | 43 | 145 | 83 | 1k+ | Exception output is not escaped | ||
| #4322 | ShinyStat Analytics | 43 | 65 | 8 | 1k+ | Output is not escaped | ||
| #4323 | Simple Revisions Delete | 43 | 16 | 26 | 10k+ | Output is not escaped | ||
| #4324 | Simple Shipping Labels for WooCommerce | 43 | 78 | 12 | 1k+ | Output is not escaped | ||
| #4325 | Simple Side Tab | 43 | 28 | 17 | 10k+ | Unsafe printing function | ||
| #4326 | Sinbyte Indexer | 43 | 61 | 19 | 2k+ | Text Domain Mismatch | ||
| #4327 | Smart App Banner | 43 | 47 | 49 | 600 | Output is not escaped | ||
| #4328 | Snazzy Maps | 43 | 9 | 62 | 30k+ | Request data is not unslashed | ||
| #4329 | Team Builder Member Showcase | 43 | 14 | 127 | 1k+ | Non-prefixed global variable | ||
| #4330 | Terms Order WP – Categories And Taxonomies Order Plugin | 43 | 12 | 47 | 900 | Non-prefixed global variable | ||
| #4331 | Theme Switcha – Easily Switch Themes for Development and Testing | 43 | 42 | 53 | 7k+ | Output is not escaped | ||
| #4332 | Theme Test Drive | 43 | 39 | 16 | 7k+ | Output is not escaped | ||
| #4333 | Uber reCaptcha | 43 | 129 | 45 | 1k+ | Text Domain Mismatch | ||
| #4334 | UPI QR Code Payment Gateway for WooCommerce | 43 | 42 | 28 | 20k+ | Output is not escaped | ||
| #4335 | User role based shipping methods | 43 | 53 | 7 | 400 | Output is not escaped | ||
| #4336 | User Role Editor | 43 | 117 | 145 | 700k+ | Output is not escaped | ||
| #4337 | User Session Control | 43 | 31 | 21 | 700 | Output is not escaped | ||
| #4338 | utm.codes | 43 | 34 | 33 | 400 | Missing nonce verification | ||
| #4339 | VA Simple Expires | 43 | 25 | 31 | 800 | Output is not escaped | ||
| #4340 | Sovrn | 43 | 9 | 29 | 1k+ | Input is not sanitized | ||
| #4341 | WIP Custom Login | 43 | 21 | 37 | 700 | Nonce verification recommended | ||
| #4342 | WP Extra File Types | 43 | 11 | 26 | 40k+ | Request data is not unslashed | ||
| #4343 | WP Hotel Booking WPML Support | 43 | 10 | 52 | 400 | Direct Query | ||
| #4344 | WP Post Expires | 43 | 21 | 15 | 2k+ | Output is not escaped | ||
| #4345 | WP SmartCrop | 43 | 43 | 12 | 4k+ | Output is not escaped | ||
| #4346 | WPC Countdown Timer for WooCommerce | 43 | 52 | 36 | 1k+ | Output is not escaped | ||
| #4347 | Active Campaign & Contact Form 7 | 43 | 40 | 27 | 3k+ | Output is not escaped | ||
| #4348 | Admin login URL Change | 44 | 38 | 11 | 2k+ | Output is not escaped | ||
| #4349 | Advanced Custom Fields: oEmbed Field | 44 | 36 | 13 | 900 | Text Domain Mismatch | ||
| #4350 | BBQ Firewall – Fast & Powerful Firewall Security | 44 | 17 | 17 | 100k+ | Output is not escaped |
