Security context

What an agent needs to avoid regressing past fixes and find the next vuln in this repo.

pojome/activity-log

              master @ 9c526d0
            

Fixes

CVEs

HIGH

Peak severity

100.0%

Coverage

Highlights

Reflected XSS: 1 prior fix. Scrutinize any change in this area.

classes/class-aal-activity-log-list-table.php: most-fixed (3 issues). Treat as high-risk during review.

1 high-severity fix in this history; regressions here are high-impact.

Recurring patterns

The bug types that recur here, drawn from past fixes, not open vulnerabilities.

SQL Injection: ORDER BY clause built from user input without validation allows database manipulation; fixed once but high impact.

Stored XSS: Persistent data (object names, titles) echoed unescaped across multiple hook components; fixed with esc_html but sibling paths may still miss encoding.

Reflected XSS: Request parameters reflected into HTML attributes without attribute-specific encoding; fixed with esc_attr but other admin UI echoes may be unguarded.