PluginScore

WordPress.Security.ValidatedSanitizedInput.MissingUnslash

Request data is not unslashed

Input from a WordPress request superglobal is used before removing WordPress-added slashes.

critical weight

Why It Shows Up

WordPress adds slashes to request data for historical compatibility. The scan found `$_GET`, `$_POST`, `$_REQUEST`, or similar input used without `wp_unslash()`.

Why It Matters

Sanitizing slashed data can produce incorrect values, failed comparisons, broken validation, or stored data that does not match what the user submitted.

How to Fix

  • Read the specific request key, then call `wp_unslash()` on it.
  • Sanitize the unslashed value with a function that matches the expected data type.
  • Validate the sanitized value before using it in permissions, queries, redirects, or stored settings.

References

WordPress validating, sanitizing, and escaping

Affected Plugins

RankPluginScoreErrorsWarningsInstallsAddedUpdatedTop Issue
#1BulletProof Security05,0484,94920k+Output is not escaped
#2Intercom060716k+Non-prefixed function
#3Live Shopping & Shoppable Videos For WooCommerce079174400Non-prefixed global variable
#4Plugin Check (PCP)012813210k+Exception output is not escaped
#5Themify Builder95,3042,1365k+Text Domain Mismatch
#6JetBackup – Backup, Restore & Migrate101,563149200k+Exception output is not escaped
#7Easy WP SMTP – WordPress SMTP and Email Logs: Gmail SMTP, Office 365, Outlook, Custom SMTP, and more1545166500k+Database parameter is not escaped
#8Visual Composer Website Builder168232040k+Non-prefixed global variable
#9MDTF – Meta Data and Taxonomies Filter161,5501,9561k+Non-prefixed global variable
#10AnyComment174454495k+Output is not escaped
#11RestroPress – Online Food Ordering System175243,1551k+Non-prefixed global variable
#12Efí Bank17886553400Exception output is not escaped
#13Dynamic Team Manager – Team Member Showcase with grid, slider, table Elementor widget & shortcode179222,014900Non-prefixed global variable
#14wpForo Forum174,0482,92220k+Unsafe printing function
#15WPtouch – Make your WordPress Website Mobile-Friendly171,46632550k+Text Domain Mismatch
#16Pagopar – WooCommerce Gateway185301,215400Non-prefixed global variable
#17Podlove Podcast Publisher182,3541,4333k+Output is not escaped
#18Property Hive181,9576,0273k+Missing nonce verification
#19Realtyna Organic IDX plugin + WPL Real Estate189303,6362k+Non-prefixed global variable
#20Shopping Cart & eCommerce Store185,37317,4663k+Non-prefixed global variable
#21WPPizza – A Restaurant Plugin184,6892,7031k+Text Domain Mismatch
#22Element Pack Addons for Elementor – Elementor Widgets, Elementor Templates, Elementor Addons1910,340360100k+Text Domain Mismatch
#23Advanced File Manager – Ultimate File Manager for WordPress And Document Library Solution191,218901100k+Exception output is not escaped
#24Go Fetch Jobs (for WP Job Manager)191,4101,741600Non-prefixed global variable
#25AI Infographic Maker191,383599600Output is not escaped
#26JetFormBuilder — Dynamic Blocks Form Builder192,1031,60480k+Text Domain Mismatch
#27Leaflet Maps Marker (Google Maps, OpenStreetMap, Bing Maps)193,2753,2289k+Output is not escaped
#28Matomo Analytics – Powerful, Privacy-First Insights for WordPress191,900877100k+Exception output is not escaped
#29Netgsm193343081k+Setting is missing a sanitization callback
#30Verified Reviews (Avis Vérifiés)196711,136700Non-prefixed global variable
#31Razorpay Payment Button Plugin19486982k+Exception output is not escaped
#32Really Simple Security – Simple and Performant Security (formerly Really Simple SSL)195363793m+Missing Translators Comment
#33Membership Plugin – Kadence Memberships195,0832,9829k+Text Domain Mismatch
#34Scrollsequence – Cinematic Scroll Image Animation Plugin198781,5284k+Non-prefixed global variable
#35SendPress Newsletters192,2931,4221k+Output is not escaped
#36SureCart – Ecommerce Made Easy For Selling Physical Products, Digital Downloads, Subscriptions, Donations, & Payments195331,14980k+Non-prefixed global variable
#37WP Email Template193443452k+Exception output is not escaped
#38WP Import Export Lite1973797940k+Non-prefixed global variable
#39WP Directory Kit191,5042,6382k+Non-prefixed global variable
#40WPJAM Basic193253464k+Output is not escaped
#41WPOSS阿里云对象存储19269315900Non-prefixed namespace
#42WPQiNiu七牛云对象存储19138612400Non-prefixed global variable
#43AweBooking – Hotel Booking System203095141k+Non-prefixed global variable
#44Brizy – Page Builder2058672670k+Output is not escaped
#45Broadstreet20434273700Output is not escaped
#46Post Form – Registration Form – Profile Form for User Profiles – Frontend Content Forms for User Submissions (UGC)207362,112900Non-prefixed global variable
#47SysBasics Customize My Account for WooCommerce – Live My Account Customizer207439118k+Non-prefixed global variable
#48Download Monitor204231,36480k+Non-prefixed hook name
#49Event Espresso – Event Registration & Ticketing Sales2012,6982,135600Text Domain Mismatch
#50Event Organiser201,10454420k+Text Domain Mismatch