Security context
What an agent needs to avoid regressing past fixes and find the next vuln in this repo.
wp-plugins/redirection
master @ 01c117c
10
Fixes
0
CVEs
HIGH
Peak severity
80.0%
Coverage
Highlights
Reflected XSS: 5 prior fixes. Scrutinize any change in this area.
ajax.php: most-fixed (2 issues). Treat as high-risk during review.
2 high-severity fixes in this history; regressions here are high-impact.
Recurring patterns
The bug types that recur here, drawn from past fixes, not open vulnerabilities.
Auth Bypass: AJAX endpoint registration lacked capability restriction checks, allowing unprivileged users to access sensitive administrative routes. Ensuring all registered AJAX endpoints are strictly wrapped in capability checks is critical.
XXE: Parsing of XML payloads during import/export operations introduced XXE risks, leading to the complete removal of the XML feature. Any future XML-parsing logic must explicitly disable external entity resolution to prevent reintroducing this flaw.
Reflected XSS: Rendering redirection logs and item properties without correct output sanitization allowed malicious payloads (such as unsanitized URLs or referrers) to execute in the admin context. Always utilize WordPress-native sanitization functions for variable reflection.