WordPress.Security.ValidatedSanitizedInput.MissingUnslash
Request data is not unslashed
Input from a WordPress request superglobal is used before removing WordPress-added slashes.
Why It Shows Up
WordPress adds slashes to request data for historical compatibility. The scan found `$_GET`, `$_POST`, `$_REQUEST`, or similar input used without `wp_unslash()`.
Why It Matters
Sanitizing slashed data can produce incorrect values, failed comparisons, broken validation, or stored data that does not match what the user submitted.
How to Fix
- Read the specific request key, then call `wp_unslash()` on it.
- Sanitize the unslashed value with a function that matches the expected data type.
- Validate the sanitized value before using it in permissions, queries, redirects, or stored settings.
Affected Plugins
| Rank | Plugin | Score | Errors | Warnings | Installs | Added | Updated | Top Issue |
|---|---|---|---|---|---|---|---|---|
| #5151 | SearchWP Live Ajax Search | 78 | 8 | 23 | 50k+ | Non-prefixed global variable | ||
| #5152 | Sendy | 78 | 11 | 2 | 500 | Output is not escaped | ||
| #5153 | Spider Blocker | 78 | 19 | 9 | 20k+ | Missing Translators Comment | ||
| #5154 | Typing Text – Add Animated Typing Effects to Headings or Text | 78 | 4 | 25 | 3k+ | Non-prefixed class | ||
| #5155 | Thumbnails and Featured Images | 78 | 16 | 14 | 1k+ | Short PHP open tag found | ||
| #5156 | Tock Widget | 78 | 6 | 9 | 400 | Missing direct file access protection | ||
| #5157 | Wheel of Life: Coaching and Assessment Tool for Life Coach | 78 | 3 | 113 | 3k+ | Non-prefixed global variable | ||
| #5158 | Wisepops Popups & Notifications | 78 | 15 | 500 | Nonce verification recommended | |||
| #5159 | WP Faster | 78 | 7 | 12 | 1k+ | trademarked term | ||
| #5160 | Import / Export Customizer Settings | 79 | 5 | 13 | 50k+ | Input is not sanitized | ||
| #5161 | Auto Featured Image (Auto Post Thumbnail) | 79 | 5 | 30 | 50k+ | Non-prefixed hook name | ||
| #5162 | Better Font Awesome | 79 | 6 | 9 | 70k+ | Input is not sanitized | ||
| #5163 | Blocks for Products | 79 | 18 | 13 | 400 | Non Singular String Literal Domain | ||
| #5164 | Click To Copy – Copy Text or Code to Clipboard Instantly | 79 | 9 | 8 | 900 | Text Domain Mismatch | ||
| #5165 | Contact Form 7 Get and Show Parameter from URL | 79 | 3 | 10 | 800 | Input is not sanitized | ||
| #5166 | Custom Background Changer | 79 | 48 | 11 | 1k+ | Non Singular String Literal Domain | ||
| #5167 | Exclude Pages From Menu | 79 | 6 | 11 | 8k+ | Non-prefixed function | ||
| #5168 | JSON API Auth | 79 | 5 | 11 | 700 | Non-prefixed function | ||
| #5169 | Klaviyo | 79 | 26 | 86 | 100k+ | Non-prefixed function | ||
| #5170 | Manage Privacy Options Page | 79 | 3 | 11 | 1k+ | Input is not validated | ||
| #5171 | Oxyplug Preload | 79 | 7 | 9 | 500 | Output is not escaped | ||
| #5172 | تقویم فارسی – Persian Calendar | 79 | 2 | 8 | 2k+ | Nonce verification recommended | ||
| #5173 | Related Products Manager for WooCommerce | 79 | 9 | 43 | 1k+ | Non-prefixed global variable | ||
| #5174 | Remove Category URL – Remove 'category' base from category permalinks | 79 | 5 | 8 | 50k+ | Missing direct file access protection | ||
| #5175 | Remove noreferrer | 79 | 17 | 14 | 5k+ | Missing Arg Domain | ||
| #5176 | SSH SFTP Updater Support | 79 | 6 | 31 | 10k+ | Non-prefixed global variable | ||
| #5177 | Testimonial Customer Feedback | 79 | 3 | 6 | 1k+ | Nonce verification recommended | ||
| #5178 | Customizer for WooCommerce | 79 | 4 | 6 | 20k+ | Missing nonce verification | ||
| #5179 | New Relic Reporting for WordPress | 79 | 4 | 16 | 600 | Nonce verification recommended | ||
| #5180 | WP Page Loading | 79 | 14 | 9 | 800 | Text Domain Mismatch | ||
| #5181 | WP Permastructure | 79 | 14 | 6 | 400 | Missing Arg Domain | ||
| #5182 | WP Referral Code | 79 | 18 | 19 | 600 | Missing direct file access protection | ||
| #5183 | WPC Additional Variation Images for WooCommerce | 79 | 4 | 26 | 800 | Non-prefixed class | ||
| #5184 | AMS Hide Page and Post Title | 80 | 4 | 6 | 500 | Input is not sanitized | ||
| #5185 | Button | 80 | 65 | 28 | 2k+ | Text Domain Mismatch | ||
| #5186 | wModes – Catalog Mode, Product Pricing, Enquiry Forms & Promotions | for WooCommerce | 80 | 465 | 900 | Non-prefixed global variable | |||
| #5187 | Cost Calculator for Elementor | 80 | 223 | 17 | 500 | wp function not compatible with requires wp | ||
| #5188 | Cresta Help Chat | 80 | 6 | 6 | 10k+ | Output is not escaped | ||
| #5189 | Docxpresso | 80 | 9 | 14 | 2k+ | Input is not sanitized | ||
| #5190 | Easy Charts | 80 | 13 | 28 | 1k+ | Non-prefixed global variable | ||
| #5191 | Extended Title Remover | 80 | 14 | 4 | 1k+ | wp function not compatible with requires wp | ||
| #5192 | Flipbox | 80 | 14 | 17 | 2k+ | wp function not compatible with requires wp | ||
| #5193 | Hizzle CAPTCHA – Protect your forms from spam | 80 | 4 | 27 | 500 | Non-prefixed global variable | ||
| #5194 | Image Captcha For Gravity Forms | 80 | 20 | 10 | 400 | Text Domain Mismatch | ||
| #5195 | Leadinfo | 80 | 11 | 8 | 7k+ | Missing direct file access protection | ||
| #5196 | Mu Manager – Manage mu-plugins like standard plugins | 80 | 21 | 18 | 800 | Missing Arg Domain | ||
| #5197 | Plugin Toggle | 80 | 2 | 12 | 500 | Nonce verification recommended | ||
| #5198 | Podamibe Custom User Gravatar | 80 | 12 | 8 | 3k+ | Non Singular String Literal Domain | ||
| #5199 | Pro Mime Types – Manage file media types | 80 | 55 | 98 | 2k+ | Non-prefixed global variable | ||
| #5200 | Quick Edit Yoast SEO | 80 | 5 | 12 | 900 | Request data is not unslashed |
