All output should be run through an escaping function (see the Security sections in the WordPress Developer Handbooks), found '$format'.

All output should be run through an escaping function (see the Security sections in the WordPress Developer Handbooks), found 'self'.

All output should be run through an escaping function (see the Security sections in the WordPress Developer Handbooks), found '$this'.

All output should be run through an escaping function (see the Security sections in the WordPress Developer Handbooks), found '$this'.

All output should be run through an escaping function (see the Security sections in the WordPress Developer Handbooks), found 'add_query_arg'.

All output should be run through an escaping function (see the Security sections in the WordPress Developer Handbooks), found '$html'.

All output should be run through an escaping function (see the Security sections in the WordPress Developer Handbooks), found '$html'.

All output should be run through an escaping function (see the Security sections in the WordPress Developer Handbooks), found 'new'.

All output should be run through an escaping function (see the Security sections in the WordPress Developer Handbooks), found '$options'.

All output should be run through an escaping function (see the Security sections in the WordPress Developer Handbooks), found '$id'.

Using exclusionary parameters, like post__not_in, in calls to get_posts() should be done with caution, see https://wpvip.com/documentation/performance-improvements-by-removing-usage-of-post__not_in/ for more information.

Processing form data without nonce verification.

Processing form data without nonce verification.

Processing form data without nonce verification.

Processing form data without nonce verification.

Processing form data without nonce verification.

Processing form data without nonce verification.

Processing form data without nonce verification.

Processing form data without nonce verification.