WordPress.Security.ValidatedSanitizedInput.MissingUnslash
Request data is not unslashed
Input from a WordPress request superglobal is used before removing WordPress-added slashes.
Why It Shows Up
WordPress adds slashes to request data for historical compatibility. The scan found `$_GET`, `$_POST`, `$_REQUEST`, or similar input used without `wp_unslash()`.
Why It Matters
Sanitizing slashed data can produce incorrect values, failed comparisons, broken validation, or stored data that does not match what the user submitted.
How to Fix
- Read the specific request key, then call `wp_unslash()` on it.
- Sanitize the unslashed value with a function that matches the expected data type.
- Validate the sanitized value before using it in permissions, queries, redirects, or stored settings.
Affected Plugins
| Rank | Plugin | Score | Errors | Warnings | Installs | Added | Updated | Top Issue |
|---|---|---|---|---|---|---|---|---|
| #5101 | Honeypot Plus for Contact Form 7 | 77 | 3 | 17 | 700 | Missing nonce verification | ||
| #5102 | Color Your Bar | 77 | 5 | 10 | 400 | Input is not sanitized | ||
| #5103 | CodeKit – Custom Codes Editor | 77 | 11 | 29 | 5k+ | Non-prefixed global variable | ||
| #5104 | Custom Fonts – Host Your Fonts Locally | 77 | 14 | 20 | 400k+ | Request data is not unslashed | ||
| #5105 | Custom HTML Block Extension | 77 | 8 | 13 | 7k+ | Missing direct file access protection | ||
| #5106 | Disable WP Registration Page Spam | 77 | 5 | 12 | 1k+ | Nonce verification recommended | ||
| #5107 | Ecomail | 77 | 7 | 13 | 1k+ | Non-prefixed global variable | ||
| #5108 | ELEX Hide WooCommerce Shipping Methods | 77 | 83 | 54 | 1k+ | Text Domain Mismatch | ||
| #5109 | eSewa – Nepal First Payment Gateway | 77 | 48 | 9 | 600 | Text Domain Mismatch | ||
| #5110 | RSS Aggregator by Feedzy – Feed to Post, Autoblogging, News & YouTube Video Feeds Aggregator | 77 | 37 | 282 | 40k+ | Non-prefixed global variable | ||
| #5111 | WP-FormAssembly | 77 | 4 | 15 | 2k+ | Nonce verification recommended | ||
| #5112 | Ilmenite Cookie Consent | 77 | 6 | 11 | 2k+ | Setting is missing a sanitization callback | ||
| #5113 | Internet Archive Wayback Machine Link Fixer | 77 | 2 | 22 | 1k+ | Database parameter is not escaped | ||
| #5114 | Photo & Video Gallery – Image, Video & Portfolio | 77 | 4 | 10 | 1k+ | Missing Version | ||
| #5115 | SureRank SEO – Smart Assistant with Meta Tags, Social Preview, XML Sitemap, and Schema | 77 | 58 | 95 | 300k+ | Non-prefixed hook name | ||
| #5116 | Table Of Contents Block | 77 | 15 | 8 | 10k+ | wp function not compatible with requires wp | ||
| #5117 | Template Kit – Import | 77 | 41 | 60 | 400k+ | Non-prefixed global variable | ||
| #5118 | Toggle wpautop | 77 | 4 | 15 | 9k+ | trademarked term | ||
| #5119 | Unattach | 77 | 4 | 11 | 900 | Nonce verification recommended | ||
| #5120 | UsageDD | 77 | 8 | 3 | 1k+ | Output is not escaped | ||
| #5121 | Username | 77 | 5 | 8 | 700 | Deprecated function: screen_icon | ||
| #5122 | Widget Classes | 77 | 5 | 7 | 1k+ | Missing nonce verification | ||
| #5123 | Album Photostream Flickr Gallery | 77 | 30 | 31 | 1k+ | Text Domain Mismatch | ||
| #5124 | Lorem Ipsum Generator | 77 | 7 | 9 | 500 | Missing direct file access protection | ||
| #5125 | WP Night Mode | 77 | 8 | 11 | 700 | Non-prefixed function | ||
| #5126 | WP Upload Size | 77 | 6 | 14 | 2k+ | Non-prefixed function | ||
| #5127 | ELEX WooCommerce Address Validation & Google Address Autocomplete Plugin | 78 | 73 | 40 | 700 | Missing Arg Domain | ||
| #5128 | Instant AI Image Generator – Create & Import Images | 78 | 23 | 1k+ | Non-prefixed constant | |||
| #5129 | Animated Text Block – Add Typing and Looping Text Effects | 78 | 5 | 25 | 4k+ | Non-prefixed class | ||
| #5130 | Biteship Shipping | 78 | 25 | 16 | 500 | wp function not compatible with requires wp | ||
| #5131 | Boei – AI Chatbot, Live Chat & 50+ Channels for WordPress | 78 | 9 | 4 | 1k+ | Output is not escaped | ||
| #5132 | Booking System Trafft | 78 | 3 | 19 | 400 | Nonce verification recommended | ||
| #5133 | Bookvault | 78 | 13 | 10 | 700 | Nonce verification recommended | ||
| #5134 | Date Picker For Contact Form 7 | 78 | 3 | 8 | 4k+ | Missing nonce verification | ||
| #5135 | Forget About Shortcode Buttons | 78 | 11 | 25 | 20k+ | Missing direct file access protection | ||
| #5136 | Interact: Embed A Quiz On Your Site | 78 | 6 | 13 | 3k+ | Request data is not unslashed | ||
| #5137 | Layouts for Elementor | 78 | 27 | 1k+ | Non-prefixed global variable | |||
| #5138 | Layouts for WPBakery | 78 | 28 | 3k+ | Non-prefixed global variable | |||
| #5139 | LH HSTS | 78 | 3 | 12 | 600 | Input is not sanitized | ||
| #5140 | Album Gallery for Photo & Video | 78 | 7 | 8 | 4k+ | wp function not compatible with requires wp | ||
| #5141 | One Time Login | 78 | 7 | 8 | 40k+ | Nonce verification recommended | ||
| #5142 | PatternsWP – Gutenberg Block Patterns & Page Templates Library | 78 | 1 | 25 | 500 | Non-prefixed constant | ||
| #5143 | Post Order By Category | 78 | 1 | 12 | 900 | Missing nonce verification | ||
| #5144 | PRENA – Product Pre-Orders for WooCommerce | 78 | 6 | 29 | 2k+ | Request data is not unslashed | ||
| #5145 | Rename XMLRPC | 78 | 7 | 3 | 1k+ | Output is not escaped | ||
| #5146 | Resend Welcome Email | 78 | 5 | 9 | 1k+ | Nonce verification recommended | ||
| #5147 | RSS Includes Pages | 78 | 4 | 8 | 10k+ | Output is not escaped | ||
| #5148 | Run SQL Query | 78 | 13 | 8 | 600 | Non-prefixed global variable | ||
| #5149 | Animator – Scroll Triggered Animations | 78 | 16 | 24 | 1k+ | Missing direct file access protection | ||
| #5150 | SearchWP Live Ajax Search | 78 | 8 | 23 | 50k+ | Non-prefixed global variable |
