All output should be run through an escaping function (see the Security sections in the WordPress Developer Handbooks), found '" <option value='*$client*'>$client</option>\n"'.
All output should be run through an escaping function (see the Security sections in the WordPress Developer Handbooks), found '" <option value='language:{$language_id}'>{$language}</option>\n"'.
All output should be run through an escaping function (see the Security sections in the WordPress Developer Handbooks), found '" <option value='{$category->slug}'>{$category->slug} ({$category->name})</option>\n"'.
All output should be run through an escaping function (see the Security sections in the WordPress Developer Handbooks), found '" <option value='{$category->slug}*'>{$category->slug}* ("'.
All output should be run through an escaping function (see the Security sections in the WordPress Developer Handbooks), found '" <option value='{$category->slug}+'>{$category->slug}+ ("'.
Affected Plugins
Plugins that have instances of this rule violation