WordPress.Security.EscapeOutput.OutputNotEscaped
Output is not escaped
Dynamic data is printed to the page without an escaping function for the output context.
Why It Shows Up
WordPress Coding Standards detected a variable, option, request value, or function result reaching HTML output without a nearby escaping call.
Why It Matters
Unescaped output can become cross-site scripting when attackers control any part of the value being printed.
How to Fix
- Use `esc_html()` for plain text, `esc_attr()` for attributes, and `esc_url()` for URLs.
- Use `wp_kses()` or `wp_kses_post()` when limited HTML is intentionally allowed.
- Escape as late as possible, right before output, so the selected escaping function matches the final context.
References
Affected Plugins
| Rank | Plugin | Score | Errors | Warnings | Installs | Added | Updated | Top Issue |
|---|---|---|---|---|---|---|---|---|
| #4401 | Gateway zibal for Woocommerce | 44 | 70 | 24 | 6k+ | Text Domain Mismatch | ||
| #4402 | Advanced Custom Fields – Contact Form 7 Field | 45 | 59 | 8 | 2k+ | Output is not escaped | ||
| #4403 | Ajax Archive Calendar | 45 | 40 | 18 | 1k+ | date date | ||
| #4404 | Back In Stock Notifier for WooCommerce | WooCommerce Waitlist Pro | 45 | 26 | 117 | 20k+ | Non-prefixed hook name | ||
| #4405 | Contact Details | 45 | 43 | 29 | 1k+ | Non Singular String Literal Text | ||
| #4406 | Contact Form 7 Signature Addon | 45 | 147 | 44 | 6k+ | Text Domain Mismatch | ||
| #4407 | Content Copy Protection & Disable Right Click | 45 | 47 | 17 | 1k+ | Output is not escaped | ||
| #4408 | Cookie Law Bar | 45 | 29 | 20 | 2k+ | Output is not escaped | ||
| #4409 | Custom Error Pages | 45 | 51 | 16 | 600 | Output is not escaped | ||
| #4410 | Easy HTML Sitemap | 45 | 75 | 8 | 600 | Text Domain Mismatch | ||
| #4411 | Extended Post Status | 45 | 27 | 27 | 1k+ | Output is not escaped | ||
| #4412 | Format Media Titles | 45 | 33 | 4 | 5k+ | Unsafe printing function | ||
| #4413 | Goftino | 45 | 16 | 20 | 10k+ | Output is not escaped | ||
| #4414 | Icons Font Loader – Load Web Fonts and Icon Libraries | 45 | 47 | 33 | 2k+ | Text Domain Mismatch | ||
| #4415 | Inazo's flamingo automatically delete old messages | 45 | 33 | 20 | 4k+ | Output is not escaped | ||
| #4416 | JetHost Total Care – Security & Enhancements | 45 | 10 | 85 | 800 | Direct Query | ||
| #4417 | LINE Auto Post | 45 | 19 | 11 | 500 | Heredoc Output Not Escaped | ||
| #4418 | New Order Notification for WooCommerce | 45 | 21 | 42 | 900 | Output is not escaped | ||
| #4419 | Outdooractive Embed | 45 | 70 | 18 | 400 | Text Domain Mismatch | ||
| #4420 | Passwords Evolved | 45 | 26 | 17 | 1k+ | Output is not escaped | ||
| #4421 | Post Date Randomizer | 45 | 42 | 6 | 9k+ | Unsafe printing function | ||
| #4422 | Product Visibility by User Role for WooCommerce | 45 | 36 | 35 | 6k+ | Missing Translators Comment | ||
| #4423 | Quick Interest Slider | 45 | 1 | 48 | 1k+ | Missing nonce verification | ||
| #4424 | reCAPTCHA for Asgaros Forum | 45 | 21 | 36 | 4k+ | Input is not validated | ||
| #4425 | ShayanWeb Admin FontChanger | افزونهی تغییر فونت پیشخوان وردپرس شایان وب | 45 | 42 | 8 | 1k+ | Output is not escaped | ||
| #4426 | Simple Login Notification | 45 | 13 | 22 | 2k+ | Request data is not unslashed | ||
| #4427 | Simple Membership MailChimp Integration | 45 | 34 | 27 | 1k+ | curl curl setopt | ||
| #4428 | Slider Templates | 45 | 10 | 33 | 1k+ | Request data is not unslashed | ||
| #4429 | Specify Missing Image Dimensions | 45 | 21 | 12 | 1k+ | Unsafe printing function | ||
| #4430 | Utimate Kit ( Styler ) for WPForms | 45 | 240 | 69 | 20k+ | Missing Arg Domain | ||
| #4431 | Super Blank | 45 | 131 | 56 | 9k+ | Missing direct file access protection | ||
| #4432 | SyntaxHighlighter Evolved | 45 | 33 | 46 | 20k+ | Not In Footer | ||
| #4433 | TriPay Payment Gateway | 45 | 478 | 44 | 1k+ | Text Domain Mismatch | ||
| #4434 | VietQR | 45 | 32 | 39 | 4k+ | Text Domain Mismatch | ||
| #4435 | WP Comment Policy Checkbox | 45 | 31 | 11 | 5k+ | Output is not escaped | ||
| #4436 | WP Global Site Tag | 45 | 48 | 9 | 7k+ | Output is not escaped | ||
| #4437 | WP OpenAPI | 45 | 26 | 22 | 400 | Output is not escaped | ||
| #4438 | WP Revisions Manager | 45 | 47 | 19 | 700 | Non Singular String Literal Domain | ||
| #4439 | wpDataTables integration for Forminator Forms | 45 | 62 | 38 | 1k+ | Text Domain Mismatch | ||
| #4440 | Batch Comment Spam Deletion | 46 | 22 | 15 | 1k+ | Nonce verification recommended | ||
| #4441 | Better image sizes | 46 | 45 | 23 | 2k+ | Text Domain Mismatch | ||
| #4442 | Bullhorn Career Portal WordPress Plugin | 46 | 46 | 7 | 1k+ | Output is not escaped | ||
| #4443 | Official CleverReach® Plugin for WooCommerce | 46 | 37 | 98 | 400 | Non-prefixed global variable | ||
| #4444 | CLP Varnish Cache | 46 | 15 | 58 | 10k+ | Non-prefixed global variable | ||
| #4445 | CoSchedule | 46 | 24 | 66 | 3k+ | Nonce verification recommended | ||
| #4446 | DarkMySite – Advanced Dark Mode Plugin for WordPress | 46 | 22 | 100 | 1k+ | Request data is not unslashed | ||
| #4447 | Delete Multiple Themes | 46 | 39 | 5 | 1k+ | Text Domain Mismatch | ||
| #4448 | Display Featured Image for Genesis | 46 | 64 | 59 | 1k+ | Non-prefixed global variable | ||
| #4449 | DX Delete Attached Media | 46 | 32 | 8 | 4k+ | Output is not escaped | ||
| #4450 | Easy Basic Authentication – Add basic auth to site or admin area | 46 | 14 | 28 | 600 | Input is not sanitized |
