Security context

What an agent needs to avoid regressing past fixes and find the next vuln in this repo.

wp-plugins/all-in-one-seo-pack

              master @ 7a3b6c9
            

Fixes

CVEs

MEDIUM

Peak severity

33.3%

Coverage

Highlights

Reflected XSS: 2 prior fixes. Scrutinize any change in this area.

all_in_one_seo_pack.php: most-fixed (2 issues). Treat as high-risk during review.

0 high-severity fixes in this history; regressions here are high-impact.

Recurring patterns

The bug types that recur here, drawn from past fixes, not open vulnerabilities.

Reflected XSS: Unescaped query arguments generated via add_query_arg are output directly, leading to Reflected XSS when navigating admin tabs. The fix requires consistent application of esc_url() or esc_url_raw() on dynamic URLs.

Stored XSS: Post metadata retrieved via get_post_meta is output directly in the post list columns without proper escaping, allowing persistent script execution. Robust sanitization using htmlspecialchars() and stripcslashes() is mandatory.

Reflected XSS: The request_as_words function fails to sanitize request-derived URLs before echoing, allowing attackers to inject malicious payloads via the request path.