WordPress.Security.ValidatedSanitizedInput.MissingUnslash

Request data is not unslashed

Input from a WordPress request superglobal is used before removing WordPress-added slashes.

critical weight

Why It Shows Up

WordPress adds slashes to request data for historical compatibility. The scan found `$_GET`, `$_POST`, `$_REQUEST`, or similar input used without `wp_unslash()`.

Why It Matters

Sanitizing slashed data can produce incorrect values, failed comparisons, broken validation, or stored data that does not match what the user submitted.

How to Fix

  • Read the specific request key, then call `wp_unslash()` on it.
  • Sanitize the unslashed value with a function that matches the expected data type.
  • Validate the sanitized value before using it in permissions, queries, redirects, or stored settings.

Affected Plugins

RankPluginScoreErrorsWarningsInstallsUpdatedTop Issue
#101Buckaroo Woocommerce Payments Plugin215633262k+Exception Not Escaped
#102WCFM – Frontend Manager for WooCommerce214,7215,06720k+Non Prefixed Variable Found
#103WebP Express21160427300k+Non Prefixed Variable Found
#104Wise Chat214705065k+Output Not Escaped
#105Paysera Payment Gateway for WooCommerce211,8661957k+Exception Not Escaped
#106Booster for WooCommerce – PDF Invoices, Abandoned Cart, Variation Swatches & 100+ Tools217863,39530k+Non Prefixed Variable Found
#107Pay For Post with WooCommerce219601,4741k+Non Prefixed Variable Found
#108PPOM – Product Addons & Custom Fields for WooCommerce213361,32520k+Non Prefixed Variable Found
#109Wordfence Security – Firewall, Malware Scan, and Login Security211,5922,9735m+Output Not Escaped
#110WP-Lister Lite for eBay216,6975,1292k+Output Not Escaped
#111WP phpMyAdmin214,5286,43550k+Missing Arg Domain
#112wpDataTables – WordPress Data Table, Dynamic Tables & Table Charts Plugin211,3541,14070k+Output Not Escaped
#113Premium Packages – Sell Digital Products Securely212,7652,4443k+Output Not Escaped
#114WPScan – WordPress Security Scanner215272658k+Text Domain Mismatch
#115Frontend Admin by DynamiApps225,9223,20810k+Text Domain Mismatch
#116Advanced Ads – Ad Manager & AdSense22578734100k+Non Prefixed Variable Found
#117Advanced Classifieds & Directory Pro221,2293,5112k+Non Prefixed Variable Found
#118Advanced Form Integration — Connect Forms to 200+ Apps225,7714,67810k+wp function not compatible with requires wp
#119Ajax Load More – Infinite Scroll, Load More, & Lazy Load2264159540k+Unsafe Printing Function
#120All-in-One Video Gallery229112,89220k+Non Prefixed Variable Found
#121Booking for Appointments and Events Calendar – Amelia221,48948090k+Exception Not Escaped
#122Shortcodes and extra features for Phlox theme2241342690k+Output Not Escaped
#123Knowledge Base documentation & wiki plugin – BasePress Docs226711,7672k+Non Prefixed Variable Found
#124Borderless – Addons and Templates for Elementor224381,3885k+Non Prefixed Variable Found
#125Better Messages – Chat Rooms, Group Chat, Private Messages & AI Chat Bots221,6042,01910k+Direct Query
#126BuddyPress225839,008100k+Non Prefixed Function Found
#127Better WordPress Minify224124848k+Non Singular String Literal Domain
#128Captcha by BestWebSoft – Advanced Spam Protection, Math & OCR-Friendly Captcha for Site Forms2249329510k+Text Domain Mismatch
#129Message Filter for Contact Form 7221,0721,6111k+Non Prefixed Variable Found
#130Clearfy Cache – WordPress optimization plugin, Minify HTML, CSS & JS, Defer222,8581,27050k+Text Domain Mismatch
#131Code Profiler – WordPress Performance Profiling and Debugging Made Easy222654008k+Non Prefixed Variable Found
#132Passster – Password Protect Pages and Content225391,41910k+Non Prefixed Variable Found
#133RegistrationMagic – User Registration Forms Plugin223,6545,0628k+Non Prefixed Variable Found
#134WP Customer Area223,30894110k+Text Domain Mismatch
#135SysBasics Customize My Account for WooCommerce – Dashboard, Endpoints, Avatar & Menu Manager227038418k+Non Prefixed Variable Found
#136Download Manager222,2901,301100k+Output Not Escaped
#137Dynamic QR Code – generator222382086k+missing direct file access protection
#138E2Pdf – Export Pdf Tool for WordPress221,07583610k+Unsafe Printing Function
#139Easy Social Feed – Social Photos Gallery and Post Feed for WordPress221,5671,27730k+Non Prefixed Variable Found
#140EleSpare – News, Magazine and Blog Addons for Elementor227331,42310k+Non Prefixed Variable Found
#141Estatik Real Estate Plugin223,04932510k+Text Domain Mismatch
#142Events Manager – Calendar, Bookings, Tickets, and more!224,7225,62170k+Output Not Escaped
#143Falang multilanguage for WordPress227167691k+Output Not Escaped
#144File Manager Pro – Filester22565391100k+Missing Unslash
#145Finale Lite – Sales Countdown Timer & Discount for WooCommerce221,0314514k+Output Not Escaped
#146FireBox Popups – Increase Sales and Grow Your Email List221538127k+Non Prefixed Variable Found
#147Notification Bar, Announcement and Cookie Notice WordPress Plugin – FooBar221,3211,3713k+Non Prefixed Variable Found
#148Five Star Restaurant Menu and Food Ordering227526095k+Output Not Escaped
#149FunnelKit Payment Gateway for Stripe WooCommerce2224432120k+Input Not Sanitized
#150GeoDirectory – WP Business Directory Plugin and Classified Listings Directory224,4623,97210k+Output Not Escaped