PluginScore

WordPress.Security.ValidatedSanitizedInput.MissingUnslash

Request data is not unslashed

Input from a WordPress request superglobal is used before removing WordPress-added slashes.

critical weight

Why It Shows Up

WordPress adds slashes to request data for historical compatibility. The scan found `$_GET`, `$_POST`, `$_REQUEST`, or similar input used without `wp_unslash()`.

Why It Matters

Sanitizing slashed data can produce incorrect values, failed comparisons, broken validation, or stored data that does not match what the user submitted.

How to Fix

  • Read the specific request key, then call `wp_unslash()` on it.
  • Sanitize the unslashed value with a function that matches the expected data type.
  • Validate the sanitized value before using it in permissions, queries, redirects, or stored settings.

References

WordPress validating, sanitizing, and escaping

Affected Plugins

RankPluginScoreErrorsWarningsInstallsAddedUpdatedTop Issue
#101Front End Users217192,759400Non-prefixed global variable
#102Frontend Dashboard21384945500Non-prefixed function
#103Imagify Image Optimization: Optimize Images | Compress & Convert to WebP/AVIF214288671m+Non-prefixed global variable
#104LA-Studio Element Kit for Elementor218,4031,88210k+Text Domain Mismatch
#105Leyka212573,4462k+Request data is not unslashed
#106Mapster WP Maps213,4402,8943k+Text Domain Mismatch
#107Mergado Pack212,323588700Output is not escaped
#108Modular DS: Monitor, update, and backup multiple websites211918240k+Exception output is not escaped
#109Mooberry Book Manager211,0403991k+Text Domain Mismatch
#110MotoPress Hotel Booking213,0671,03710k+Text Domain Mismatch
#111Points Management System For Gamification, Ranks, Badges, and Loyalty Rewards Program – myCred211,4813,34410k+Non-prefixed global variable
#112Oasis Workflow21775575600Text Domain Mismatch
#113OneLogin SAML SSO215073307k+wp function not compatible with requires wp
#114Landing Page Builder – Coming Soon page, Maintenance Mode, Lead Page, WordPress Landing Pages211,1202,9139k+Non-prefixed global variable
#115Paid Membership Subscriptions – Effortless Memberships, Recurring Payments & Content Restriction211,9535,29710k+Non-prefixed hook name
#116PeachPay — Payments & Express Checkout for WooCommerce (supports Stripe, PayPal, Square, Authorize.net, NMI)21485813300Missing direct file access protection
#117User Profile Builder – Beautiful User Registration Forms, User Profiles & User Role Editor217031,46340k+Missing Translators Comment
#118PublishPress Planner – Editorial Calendar, Marketing Content, Kanban Board216038906k+Output is not escaped
#119Quill Forms | Conversational Multi Step Forms, Surveys & quizzes214013703k+Text Domain Mismatch
#120Razorpay for Gravity Forms2141147600Exception output is not escaped
#121Razorpay Quick Payments21399632k+Exception output is not escaped
#122Five Star Restaurant Reservations – WordPress Booking Plugin211,1011,15910k+Output is not escaped
#123Rocket Maintenance Mode & Coming Soon Page211,1761,4064k+Non-prefixed global variable
#124Royal Addons for Elementor – Addons and Templates Kit for Elementor2113,0162,440600k+Text Domain Mismatch
#125Seamless Donations is Sunset216005142k+Text Domain Mismatch
#126SeatReg213121,637400Missing nonce verification
#127Professional Social Sharing Buttons, Icons & Related Posts – Shareaholic2132718110k+Output is not escaped
#128Smart Forms – when you need more than just a contact form217765745k+Output is not escaped
#129Accept Stripe Payments2137389220k+Missing nonce verification
#130Testerwp ecommerce companion218114361k+Text Domain Mismatch
#131ThirstyAffiliates – Affiliate Links, Link Branding, Link Tracking & Marketing Plugin2119066030k+Non-prefixed global variable
#132TotalPoll for Polls and Contests211,3661551k+Text Domain Mismatch
#133Trace My IP – Visitor IP Tracker, Stats Analytics & Page Views Counter with Email Alerts218713381k+wp function not compatible with requires wp
#134Revive Social – Social Media Auto Post and Scheduling Automation Plugin2125643120k+Non-prefixed hook name
#135Uncanny Automator – Easy Automation, Integration, Webhooks & Workflow Builder Plugin211,0742,97840k+Direct Query
#136UPC/EAN/GTIN Barcode Generator/Importer21776311500Exception output is not escaped
#137URL Shortify – Simple and Easy URL Shortener211,5112,66910k+Non-prefixed global variable
#138Buckaroo Woocommerce Payments Plugin216383212k+Exception output is not escaped
#139BuddyPress WooCommerce My Account Integration. Create WooCommerce Member Pages216681,569800Non-prefixed global variable
#140IS-theme-companion213,5595111k+Non Singular String Literal Domain
#141WebP Express21160427300k+Non-prefixed global variable
#142Wise Chat214705065k+Output is not escaped
#143Paysera Payment Gateway for WooCommerce211,8681967k+Exception output is not escaped
#144Booster for WooCommerce – PDF Invoices, Abandoned Cart, Variation Swatches & 100+ Tools217863,39330k+Non-prefixed global variable
#145Pay For Post with WooCommerce219581,4771k+Non-prefixed global variable
#146PPOM – Product Addons & Custom Fields for WooCommerce213361,31920k+Non-prefixed global variable
#147Wordfence Security – Firewall, Malware Scan, and Login Security211,8183,2365m+Output is not escaped
#148WP-Lister Lite for eBay216,7015,1322k+Output is not escaped
#149WP phpMyAdmin214,5286,43540k+Missing Arg Domain
#150wpDataTables – WordPress Data Table, Dynamic Tables & Table Charts Plugin211,8121,43270k+Output is not escaped