WordPress.Security.ValidatedSanitizedInput.MissingUnslash
Request data is not unslashed
Input from a WordPress request superglobal is used before removing WordPress-added slashes.
Why It Shows Up
WordPress adds slashes to request data for historical compatibility. The scan found `$_GET`, `$_POST`, `$_REQUEST`, or similar input used without `wp_unslash()`.
Why It Matters
Sanitizing slashed data can produce incorrect values, failed comparisons, broken validation, or stored data that does not match what the user submitted.
How to Fix
- Read the specific request key, then call `wp_unslash()` on it.
- Sanitize the unslashed value with a function that matches the expected data type.
- Validate the sanitized value before using it in permissions, queries, redirects, or stored settings.
Affected Plugins
| Rank | Plugin | Score | Errors | Warnings | Installs | Added | Updated | Top Issue |
|---|---|---|---|---|---|---|---|---|
| #5201 | WP Video Popup – WordPress Video Lightbox for YouTube, Rumble & Vimeo | 80 | 5 | 14 | 9k+ | wp function not compatible with requires wp | ||
| #5202 | Smart Passworded Pages | 80 | 11 | 8 | 2k+ | wp function not compatible with requires wp | ||
| #5203 | Mini Cart Drawer For WooCommerce | 80 | 4 | 25 | 400 | Non-prefixed hook name | ||
| #5204 | WP Delete User Accounts | 80 | 10 | 7 | 800 | Missing direct file access protection | ||
| #5205 | atec Cache APCu | 81 | 41 | 21 | 3k+ | wp function not compatible with requires wp | ||
| #5206 | Authorsy – Author Box, Multiple Authors, Guest Authors & Post Rating | 81 | 1 | 20 | 1k+ | Request data is not unslashed | ||
| #5207 | Auto iFrame | 81 | 2 | 11 | 3k+ | Input is not sanitized | ||
| #5208 | Auto Post Expiration | 81 | 12 | 4 | 800 | Text Domain Mismatch | ||
| #5209 | Block Visibility — Conditional Visibility Control for the Block Editor | 81 | 7 | 11 | 40k+ | Input is not sanitized | ||
| #5210 | Change Permalink Helper | 81 | 5 | 5 | 900 | Direct Query | ||
| #5211 | Countdown Block | 81 | 14 | 10 | 4k+ | wp function not compatible with requires wp | ||
| #5212 | Joinchat – Enhanced "click to chat" | 81 | 17 | 32 | 700k+ | wp function not compatible with requires wp | ||
| #5213 | Disable Gutenberg Blocks – Block Manager | 81 | 6 | 10 | 4k+ | trademarked term | ||
| #5214 | ERE Recently Viewed – Essential Real Estate Add-On | 81 | 6 | 3 | 1k+ | Output is not escaped | ||
| #5215 | External Thumbnail | 81 | 6 | 5 | 20k+ | Missing nonce verification | ||
| #5216 | FAQ Schema For Pages And Posts | 81 | 56 | 5 | 7k+ | Text Domain Mismatch | ||
| #5217 | GIF Master – Awesome GIFs with Giphy and Tenor | 81 | 7 | 6 | 3k+ | Output is not escaped | ||
| #5218 | Info Cards – Add Text and Media in Card Layouts | 81 | 7 | 25 | 2k+ | Non-prefixed namespace | ||
| #5219 | Nice Search | 81 | 4 | 5 | 900 | Input is not sanitized | ||
| #5220 | Open in New Window Plugin | 81 | 6 | 8 | 2k+ | Offloaded Content | ||
| #5221 | Order Approval for Woocommerce | 81 | 3 | 208 | 1k+ | Non-prefixed global variable | ||
| #5222 | Physical Custom Upload Folder for Real Media Library | 81 | 4 | 9 | 900 | Nonce verification recommended | ||
| #5223 | Portfolio Block – The Ultimate Project & Portfolio Builder | 81 | 6 | 5 | 800 | Offloaded Content | ||
| #5224 | Post Type Archive Descriptions | 81 | 11 | 4 | 1k+ | Missing direct file access protection | ||
| #5225 | Price Table Block | 81 | 15 | 16 | 900 | file system operations mkdir | ||
| #5226 | Progress Bars | 81 | 15 | 14 | 500 | file system operations mkdir | ||
| #5227 | Simple Page Redirect | 81 | 3 | 7 | 10k+ | Request data is not unslashed | ||
| #5228 | Team Member Block | 81 | 15 | 14 | 1k+ | file system operations mkdir | ||
| #5229 | Telephone field for Gravity Forms | 81 | 124 | 9 | 400 | wp function not compatible with requires wp | ||
| #5230 | Toggle Content | 81 | 16 | 12 | 700 | file system operations mkdir | ||
| #5231 | Typing Text | 81 | 15 | 16 | 600 | file system operations mkdir | ||
| #5232 | VS Event List | 81 | 1 | 259 | 8k+ | Non-prefixed global variable | ||
| #5233 | Appointment Bookings for Zoom GoogleMeet and more – Wappointment | 81 | 22 | 52 | 1k+ | Non-prefixed class | ||
| #5234 | Free Shipping Bar for WooCommerce | 81 | 5 | 21 | 2k+ | Non-prefixed global variable | ||
| #5235 | Product SKU Generator for WooCommerce | 81 | 2 | 8 | 8k+ | Nonce verification recommended | ||
| #5236 | Admin Collapse Subpages | 82 | 4 | 12 | 4k+ | Nonce verification recommended | ||
| #5237 | Advance Canonical URL | 82 | 3 | 10 | 1k+ | Input is not validated | ||
| #5238 | Intranet & Private Site – All-In-One Intranet | 82 | 1 | 11 | 4k+ | Input is not sanitized | ||
| #5239 | Bulk Menu Edit | 82 | 4 | 9 | 700 | Direct Query | ||
| #5240 | Confirm Plus Contact Form 7 | 82 | 10 | 15 | 7k+ | Non Singular String Literal Domain | ||
| #5241 | Awin Publisher MasterTag | 82 | 6 | 6 | 1k+ | Non-prefixed global variable | ||
| #5242 | Gallery for Google Photos – Import and Showcase Photo Albums | 82 | 2 | 16 | 1k+ | Input is not validated | ||
| #5243 | Head & Footer Code | 82 | 1 | 15 | 100k+ | Non-prefixed constant | ||
| #5244 | Hostinger Tools | 82 | 13 | 22 | 3m+ | wp function not compatible with requires wp | ||
| #5245 | Image Gallery Block | 82 | 13 | 10 | 3k+ | wp function not compatible with requires wp | ||
| #5246 | Infobox | 82 | 15 | 12 | 1k+ | file system operations mkdir | ||
| #5247 | Lazy Load for Videos | 82 | 6 | 37 | 9k+ | Non-prefixed constant | ||
| #5248 | Multiple Form Instances Add-on for Gravity Forms | 82 | 5 | 5 | 800 | Missing direct file access protection | ||
| #5249 | mypace Custom Meta Robots | 82 | 4 | 6 | 2k+ | Input is not sanitized | ||
| #5250 | Parallax Slider Block | 82 | 15 | 12 | 900 | file system operations mkdir |
