Escape and sanitize untrusted data [Warning]

[grappler]

There are a few checks that we can run that could help catch a few of the main issues.

1. Sanitize widget settings in the update() function in the widget class e.g. $instance['example'] = $new_instance['example'];
2. Check if $_POST, $_GET $_REQUEST are wrapped in a bracket e.g. isset( $_POST['example] ) or esc_html( $_GET['example'] )

I am sure there are a few more that will come to mind.