WordPress.Security.ValidatedSanitizedInput.MissingUnslash

Request data is not unslashed

Input from a WordPress request superglobal is used before removing WordPress-added slashes.

critical weight

Why It Shows Up

WordPress adds slashes to request data for historical compatibility. The scan found `$_GET`, `$_POST`, `$_REQUEST`, or similar input used without `wp_unslash()`.

Why It Matters

Sanitizing slashed data can produce incorrect values, failed comparisons, broken validation, or stored data that does not match what the user submitted.

How to Fix

  • Read the specific request key, then call `wp_unslash()` on it.
  • Sanitize the unslashed value with a function that matches the expected data type.
  • Validate the sanitized value before using it in permissions, queries, redirects, or stored settings.

Affected Plugins

RankPluginScoreErrorsWarningsInstallsUpdatedTop Issue
#51bbPress219293,672100k+Non Prefixed Function Found
#52Pinpoint Booking System – Version 2216343283k+missing direct file access protection
#53rtMedia for WordPress, BuddyPress and bbPress213636338k+Non Prefixed Constant Found
#54CallTrackingMetrics219232863k+Unsafe Printing Function
#55Captcha Them All213003236k+Output Not Escaped
#56CartFlows – Funnel Builder & Checkout Plugin for WooCommerce21461614200k+Text Domain Mismatch
#57Smart Grid-Layout Design for Contact Form 7211,12673410k+Output Not Escaped
#58Comet Cache2185724520k+Output Not Escaped
#59Cost Calculator Builder2132276530k+Non Prefixed Variable Found
#60Free Downloads WooCommerce214303594k+Output Not Escaped
#61Duplicator – Backups & Migration Plugin – Cloud Backups, Scheduled Backups, & More212,5721,2771m+Output Not Escaped
#62Envo Extra2187860020k+Text Domain Mismatch
#63eRoom – Webinar & Meeting Plugin for Zoom, Google Meet, Microsoft Teams211864379k+Non Prefixed Variable Found
#64ERP: Complete HR, Accounting & CRM Suite with Recruitment and WooCommerce CRM Support218295,9665k+Direct Query
#65Eupago Gateway For Woocommerce216123202k+Output Not Escaped
#66EventPrime – Events Calendar, Bookings and Tickets218724,2977k+Non Prefixed Variable Found
#67Feeds for YouTube (YouTube video, channel, and gallery plugin)21558978100k+Output Not Escaped
#68FileOrganizer – WordPress File Manager21536241200k+unlink unlink
#69Formidable Forms – WordPress Form Builder for Contact Forms, Calculators, Quizzes & More21521,959300k+Non Prefixed Variable Found
#70Campaign Monitor for WordPress213864612k+Non Prefixed Variable Found
#71If-So Dynamic Content – Elementor & All Page Builders Personalization218897257k+Unsafe Printing Function
#72Imagify: Optimize Images for Top Speed (Compress & Convert to WebP/AVIF)214188511m+Non Prefixed Variable Found
#73JCH Optimize219531334k+Output Not Escaped
#74LA-Studio Element Kit for Elementor218,3901,96410k+Text Domain Mismatch
#75MailChimp Subscribe Form, Optin Builder, PopUp Builder, Form Builder211,1333,0112k+Non Prefixed Variable Found
#76Mapster WP Maps213,4402,9033k+Text Domain Mismatch
#77Modular DS: Monitor, update, and backup multiple websites211618140k+Exception Not Escaped
#78MotoPress Hotel Booking213,0611,03710k+Text Domain Mismatch
#79Points Management System For Gamification, Ranks, Badges, and Loyalty Rewards Program – myCred211,4693,33310k+Non Prefixed Variable Found
#80OneLogin SAML SSO215083307k+wp function not compatible with requires wp
#81Packeta218023338k+Exception Not Escaped
#82Landing Page Builder – Coming Soon page, Maintenance Mode, Lead Page, WordPress Landing Pages211,1732,9839k+Non Prefixed Variable Found
#83Paid Membership Subscriptions – Effortless Memberships, Recurring Payments & Content Restriction211,9185,06510k+Non Prefixed Hookname Found
#84User Profile Builder – Beautiful User Registration Forms, User Profiles & User Role Editor216961,48350k+Recommended
#85PublishPress Planner – Editorial Calendar, Marketing Content, Kanban Board216038906k+Output Not Escaped
#86Razorpay Quick Payments21399633k+Exception Not Escaped
#87Five Star Restaurant Reservations – WordPress Booking Plugin211,0991,14710k+Output Not Escaped
#88Rocket Maintenance Mode & Coming Soon Page211,1761,4064k+Non Prefixed Variable Found
#89Royal Addons for Elementor – Addons and Templates Kit for Elementor2113,0112,530600k+Text Domain Mismatch
#90Seamless Donations is Sunset216005142k+Text Domain Mismatch
#91Professional Social Sharing Buttons, Icons & Related Posts – Shareaholic2132718110k+Output Not Escaped
#92Smart Forms – when you need more than just a contact form217765745k+Output Not Escaped
#93Accept Stripe Payments2137388220k+Missing
#94ThirstyAffiliates – Affiliate Links, Link Branding, Link Tracking & Marketing Plugin2119066030k+Non Prefixed Variable Found
#95Revive Social – Social Media Auto Post and Scheduling Automation Plugin2125542520k+Non Prefixed Hookname Found
#96Buckaroo Woocommerce Payments Plugin215633262k+Exception Not Escaped
#97WCFM – Frontend Manager for WooCommerce214,7215,06720k+Non Prefixed Variable Found
#98WebP Express21160427300k+Non Prefixed Variable Found
#99Wise Chat214705065k+Output Not Escaped
#100Paysera Payment Gateway for WooCommerce211,8661957k+Exception Not Escaped