Escape and sanitize untrusted data [Warning]

There are a few checks that we can run that could help catch a few of the main issues.

1. Sanitize widget settings in the update() function in the widget class e.g. $instance['example'] = $new_instance['example'];
2. Check if $_POST, $_GET $_REQUEST are wrapped in a bracket e.g. isset( $_POST['example] ) or esc_html( $_GET['example'] )

I am sure there are a few more that will come to mind.

Start by locating the widget class's update() function and the checks that inspect $_POST, $_GET, and $_REQUEST usage. Review the listed unsanitized widget-setting and unwrapped request examples, then define the additional cases to detect. Done means the checker reliably identifies the described unsafe patterns and covers the agreed additional cases.