Study finds AI-generated WordPress plugins often use wrong output escaping functions

A developer study examined how AI coding assistants handle output escaping in WordPress plugins, testing whether they select context-appropriate escaping functions. The research highlights that using the wrong escaper — such as esc_html() on a URL instead of esc_url() — can appear safe during code review yet still allow dangerous schemes like javascript: to execute. The analysis tested 60 AI-written plugins and found that escaping inside inline script blocks is a particularly error-prone area, where only wp_json_encode with the JSON_HEX_TAG flag reliably prevents script breakout. Functions like esc_js() and wp_json_encode with JSON_UNESCAPED_SLASHES were shown to be unsafe in script contexts, despite being commonly suggested. WordPress core itself uses the JSON_HEX_TAG approach in components like the script-modules API, with explicit code comments explaining the security rationale.