Review and apply WP security recommendations

[phwizard]

https://developer.wordpress.org/apis/security/

Our three most common reasons for not approving a plugin are:

• The plugin contains unescaped output: Learn about escaping data
• The plugin accepts unsanitised data: Learn about sanitising data
• The plugin processes form data without a nonce: Learn about nonces