PluginScore

WordPress.Security.ValidatedSanitizedInput.MissingUnslash

Request data is not unslashed

Input from a WordPress request superglobal is used before removing WordPress-added slashes.

critical weight

Why It Shows Up

WordPress adds slashes to request data for historical compatibility. The scan found `$_GET`, `$_POST`, `$_REQUEST`, or similar input used without `wp_unslash()`.

Why It Matters

Sanitizing slashed data can produce incorrect values, failed comparisons, broken validation, or stored data that does not match what the user submitted.

How to Fix

  • Read the specific request key, then call `wp_unslash()` on it.
  • Sanitize the unslashed value with a function that matches the expected data type.
  • Validate the sanitized value before using it in permissions, queries, redirects, or stored settings.

References

WordPress validating, sanitizing, and escaping

Affected Plugins

RankPluginScoreErrorsWarningsInstallsAddedUpdatedTop Issue
#851AIO Forms – Craft Complex Forms Easily25189418700Mixed line endings
#852Booking for Appointments and Events Calendar – Amelia251,48748090k+Exception output is not escaped
#853Animated Number Counters254631,9322k+Non-prefixed global variable
#854Appointment Booking Calendar253271,0551k+Non-prefixed global variable
#855Appointment Hour Booking – Booking Calendar252621,25310k+Non-prefixed global variable
#856ATUM WooCommerce Inventory Management and Stock Tracking252,6341,30610k+Non Singular String Literal Domain
#857bbp style pack251,4191,7916k+Output is not escaped
#858Beaver Builder Page Builder – Drag and Drop Website Builder254,4631,819100k+Text Domain Mismatch
#859BlockSpare – Gutenberg Post Grid Blocks for News, Magazine & Blog Websites251,3271,71410k+Non-prefixed global variable
#860Total Upkeep – WordPress Backup Plugin plus Restore & Migrate by BoldGrid2524385450k+Non-prefixed global variable
#861Booking Activities251,0361,4693k+Output is not escaped
#862Booking Calendar Contact Form25371884500Input is not validated
#863Booking Package251,6973,97710k+Missing nonce verification
#864Bookit — Booking & Appointment Calendar255651,4584k+Non-prefixed global variable
#865Online Scheduling and Appointment Booking System – Bookly251,08888860k+SQL query is not prepared
#866Breeze Cache25218800400k+Non-prefixed global variable
#867Broken Link Checker25727600500k+Output is not escaped
#868BuddyPress Docs252844217k+Nonce verification recommended
#869Bulk Edit Categories and Tags – Create Thousands Quickly on the Editor251,0411,0164k+Text Domain Mismatch
#870Bulk Edit and Create User Profiles – WP Sheet Editor259951,0011k+Text Domain Mismatch
#871PublishPress Capabilities – User Role Editor, Access Permissions, User Capabilities, Admin Menus253621,586100k+Non-prefixed global variable
#872GSheetConnector for CF7 – Connect Contact Form 7 to Google Sheets and Send Form Submissions in Real Time256141,43140k+Non-prefixed global variable
#873CheckoutWC Lite – Conversion optimized WooCommerce checkout251,4168543k+Text Domain Mismatch
#874CheckView – Form & Checkout Testing25663371k+Direct Query
#875HIPAA FORMS25414416800Request data is not unslashed
#876Admin Columns25613995100k+Non-prefixed namespace
#877Colissimo shipping methods for WooCommerce251,75555710k+Text Domain Mismatch
#878Website Builder by SeedProd — Theme Builder, Landing Page Builder, Coming Soon Page, Maintenance Mode25991,040700k+Non-prefixed global variable
#879Disable Comments & Delete All Comments255031859k+Output is not escaped
#880Contact Form to DB by BestWebSoft – Messages Database Plugin For WordPress254983551k+Text Domain Mismatch
#881Contact Form Email254098989k+Non-prefixed global variable
#882Coupon Creator256984121k+Output is not escaped
#883CP Contact Form with PayPal25466936800Unsafe printing function
#884CSS & JavaScript Toolbox2515561710k+Non-prefixed class
#885Smash Balloon Social Post Feed – Simple Social Feeds for WordPress25554982200k+Output is not escaped
#886DecaLog259432361k+Exception output is not escaped
#887Demo Importer Plus255823910k+Non-prefixed hook name
#888Disable Admin Notices – Hide Dashboard Notifications25465195100k+Output is not escaped
#889Docket Cache – Object Cache Accelerator2533348120k+Output is not escaped
#890ELEX WooCommerce Dynamic Pricing and Discounts25478748800Text Domain Mismatch
#891WEB-Translation – eTranslation Multilingual252171,057400Non-prefixed function
#892Show Eventbrite Events – Event Feed for Eventbrite255951,525800Non-prefixed global variable
#893Event Genius – Event Management, Events Calendar, Registration, and RSVP251811,579500Non-prefixed global variable
#894Events Made Easy255216,3241k+Non-prefixed function
#895F4 Post Tree255361,332500Non-prefixed global variable
#896胖鼠采集(Fat Rat Collect)25630190900Missing Arg Domain
#897FlatPM – Ad Manager, AdSense and Custom Code253,01755710k+Text Domain Mismatch
#898FluentCart A New Era of eCommerce – Faster, Lighter, and Simpler253214557k+Non-prefixed global variable
#899Fluid Checkout for WooCommerce – Lite2537084120k+Non-prefixed hook name
#900Lightbox & Modal Popup WordPress Plugin – FooBox256101,365100k+Non-prefixed global variable