Variables will not be shown to be vulnerable if they are sanitized with esc_attr (Wordpress).