Input is not sanitized

Why It Shows Up

The scan found superglobal input flowing into code without a sanitizer such as `sanitize_text_field()`, `absint()`, `sanitize_key()`, `esc_url_raw()`, or a custom allowlist.

Why It Matters

Unsanitized input can pollute stored settings, alter logic, break queries, or become part of a later security issue.

How to Fix

• Unslash request data with `wp_unslash()` first.
• Choose the sanitizer for the expected value, such as `absint()` for IDs or `sanitize_key()` for keys.
• Use allowlists for actions, sort fields, file names, option names, and other constrained values.

References