Security context

What an agent needs to avoid regressing past fixes and find the next vuln in this repo.

Automattic/jetpack

              trunk @ 674c938
            

214

Fixes

CVEs

CRITICAL

Peak severity

38.2%

Coverage

Highlights

Auth Bypass: 68 prior fixes. Scrutinize any change in this area.

class.jetpack.php: most-fixed (6 issues). Treat as high-risk during review.

131 high-severity fixes in this history; regressions here are high-impact.

Recurring patterns

The bug types that recur here, drawn from past fixes, not open vulnerabilities.

Auth Bypass: Multiple fixes corrected missing or incorrect permission callbacks, capability checks, and token requirements across REST, JSON, and XML-RPC endpoints, indicating a systemic weakness in authorization enforcement.

Reflected XSS: Numerous fixes add output encoding (esc_url, esc_attr, esc_html, textContent) to echoed variables and DOM insertions, but the breadth of sinks suggests many unescaped output paths remain.

Stored XSS: Fixes sanitize block rendering, comment content, and admin settings values, but the variety of sinks (render_block, comment_text, echo) indicates stored XSS is a persistent risk in user-generated content paths.