WordPress.Security.ValidatedSanitizedInput.MissingUnslash
Request data is not unslashed
Input from a WordPress request superglobal is used before removing WordPress-added slashes.
Why It Shows Up
WordPress adds slashes to request data for historical compatibility. The scan found `$_GET`, `$_POST`, `$_REQUEST`, or similar input used without `wp_unslash()`.
Why It Matters
Sanitizing slashed data can produce incorrect values, failed comparisons, broken validation, or stored data that does not match what the user submitted.
How to Fix
- Read the specific request key, then call `wp_unslash()` on it.
- Sanitize the unslashed value with a function that matches the expected data type.
- Validate the sanitized value before using it in permissions, queries, redirects, or stored settings.
Affected Plugins
| Rank | Plugin | Score | Errors | Warnings | Installs | Added | Updated | Top Issue |
|---|---|---|---|---|---|---|---|---|
| #4651 | Cron Jobs | 62 | 21 | 33 | 2k+ | Nonce verification recommended | ||
| #4652 | MainWP Key Maker | 62 | 3 | 35 | 4k+ | Input is not sanitized | ||
| #4653 | Nimbata Call Tracking | 62 | 13 | 11 | 400 | Non-prefixed function | ||
| #4654 | Notibar – Notification Bar for WordPress | 62 | 47 | 64 | 8k+ | wp function not compatible with requires wp | ||
| #4655 | payOS | 62 | 19 | 26 | 500 | Request data is not unslashed | ||
| #4656 | Proofreading | 62 | 11 | 74 | 5k+ | Direct Query | ||
| #4657 | Responsive Slider Gallery – Responsive Image Photo Slider | 62 | 32 | 122 | 2k+ | Non-prefixed global variable | ||
| #4658 | Easy SSL Plugin for SAKURA Rental Server | 62 | 23 | 17 | 50k+ | Input is not sanitized | ||
| #4659 | SEO Image Toolbox | 62 | 19 | 14 | 1k+ | Output is not escaped | ||
| #4660 | Single Post Template | 62 | 14 | 8 | 4k+ | Text Domain Mismatch | ||
| #4661 | Sitewide Notice WP | 62 | 6 | 13 | 3k+ | Output is not escaped | ||
| #4662 | Spam Comments Cleaner | 62 | 14 | 29 | 1k+ | Non-prefixed function | ||
| #4663 | Testimonial Carousel For Elementor | 62 | 34 | 56 | 10k+ | No Html Wrapped Strings | ||
| #4664 | Topic SEO Content Optimization Tool | 62 | 35 | 15 | 1k+ | curl curl close | ||
| #4665 | WiserNotify – Social Proof & FOMO Notifications, WooCommerce Sales Popups, Reviews & Announcement Bar | 62 | 13 | 32 | 1k+ | Request data is not unslashed | ||
| #4666 | Satispay for WooCommerce | 62 | 19 | 12 | 7k+ | Exception output is not escaped | ||
| #4667 | Embed Videos For Product Image Gallery Using WooCommerce | 62 | 21 | 16 | 400 | Text Domain Mismatch | ||
| #4668 | WooCommerce Product Fees | 62 | 6 | 25 | 2k+ | Missing nonce verification | ||
| #4669 | WP Category Sort | 62 | 15 | 22 | 500 | Text Domain Mismatch | ||
| #4670 | WP Charts and Graphs – WordPress Chart Plugin | 62 | 8 | 29 | 1k+ | Input is not sanitized | ||
| #4671 | WP Downloader | 62 | 11 | 15 | 2k+ | Output is not escaped | ||
| #4672 | Wp Theme plugin Download | 62 | 11 | 16 | 2k+ | Output is not escaped | ||
| #4673 | XPoster – Share to Bluesky and Mastodon | 62 | 26 | 36 | 10k+ | Missing nonce verification | ||
| #4674 | Zen Menu Logic | 62 | 19 | 3 | 1k+ | Output is not escaped | ||
| #4675 | Automatic Featured Images from Videos | 63 | 13 | 13 | 7k+ | Missing direct file access protection | ||
| #4676 | Categories Images | 63 | 10 | 21 | 50k+ | wp function not compatible with requires wp | ||
| #4677 | Category Sticky Post | 63 | 4 | 24 | 3k+ | Missing nonce verification | ||
| #4678 | Christmasify! | 63 | 18 | 7 | 2k+ | Output is not escaped | ||
| #4679 | Classic Editor | 63 | 17 | 7 | 9m+ | Unsafe printing function | ||
| #4680 | Classic Editor and Classic Widgets | 63 | 19 | 41 | 20k+ | Nonce verification recommended | ||
| #4681 | Creative Clans Embed Script | 63 | 10 | 9 | 600 | Input is not sanitized | ||
| #4682 | Custom post types, Custom Fields & more | 63 | 101 | 22 | 3k+ | Missing Translators Comment | ||
| #4683 | Email Post Changes | 63 | 43 | 8 | 500 | Missing Arg Domain | ||
| #4684 | Essential Addons for Elementor – Popular Elementor Templates & Widgets | 63 | 78 | 184 | 2m+ | wp function not compatible with requires wp | ||
| #4685 | Happierleads – Identify your B2B website visitors even if they work remotely | 63 | 32 | 7 | 600 | wp function not compatible with requires wp | ||
| #4686 | Hide Admin Bar From Front End | 63 | 8 | 17 | 1k+ | Input is not validated | ||
| #4687 | Image Sitemap | 63 | 11 | 14 | 400 | Output is not escaped | ||
| #4688 | Include Klaviyo for Elementor pro | 63 | 60 | 10 | 2k+ | Missing Arg Domain | ||
| #4689 | Integrate GA4 Google Analytics | 63 | 33 | 3 | 500 | Text Domain Mismatch | ||
| #4690 | Mailster Google Analytics | 63 | 26 | 9 | 900 | Output is not escaped | ||
| #4691 | Mantenimiento web | 63 | 49 | 15 | 20k+ | Text Domain Mismatch | ||
| #4692 | Missed Scheduled Posts Publisher by WPBeginner | 63 | 16 | 17 | 30k+ | Text Domain Mismatch | ||
| #4693 | One Tap Google Sign in | 63 | 6 | 30 | 900 | Request data is not unslashed | ||
| #4694 | Simple Membership After Login Redirection | 63 | 4 | 24 | 10k+ | Missing nonce verification | ||
| #4695 | Slightly troublesome permalink | 63 | 24 | 10 | 1k+ | Non Singular String Literal Domain | ||
| #4696 | Review & testimonial widgets | 63 | 62 | 9 | 1k+ | Text Domain Mismatch | ||
| #4697 | PayPing Gateway For Woocommerce | 63 | 11 | 40 | 1k+ | Non-prefixed hook name | ||
| #4698 | Phone Validator for WooCommerce | 63 | 8 | 33 | 1k+ | Missing nonce verification | ||
| #4699 | Admin filter posts by year | 64 | 8 | 32 | 400 | Non-prefixed function | ||
| #4700 | Advanced Marquee Effect for Elementor | 64 | 13 | 10 | 2k+ | Output is not escaped |
