19 replies

1. Cory Dransfeldt 2 min later

   @zachleat do you add or multiply for sites that use both?

   1. Zach Leatherman 7 min later

      @cory both are bad

      1. Cory Dransfeldt 11 min later

         @zachleat I’m terrified of both

         1. Taylor “Tigt” Hunt 17 hr later

            @cory @zachleat Doesn’t Gutenberg put React in WP by default?

            1. Cory Dransfeldt 17 hr later

               @tigt @zachleat 😰

2. Zach Leatherman 7 min later

   There are levels to this thing…

3. Cory Birdsong 16 min later

   @zachleat have you considered that Wordpress uses react in the editor?

   1. Zach Leatherman 32 min later

      @cbirdsong one-two punch!

4. Hm… I’m skeptical 31 min later

   @zachleat wordpress is always marketing sites, right? No sensitive data?

   1. Zach Leatherman 33 min later

      @jorge who is saying that 😅

5. Private reply 3 hr later
   1. Timo Tijhof 3 hr later

      @zachleat

      The equivalent for a React site would need to include:

      * unrelated third-party frontend scripts (equiv of WP theme and frontend plugins; eg WordPress plugins that just bundle and load an existing lightbox script, or analytics. Their CVEs all propagate.)

      * server-side npm deps (equiv of WP backend feature plugins; such as general monitoring/profiling).

      * dev dependencies used for the site's build steps (ie equiv of WP admin plugins; such as optimising thumbnails)

      1. Zach Leatherman 18 hr later

         @krinkle 7,813 results for JavaScript 😅

         1. Timo Tijhof 1 day later

            @zachleat

            Should be a lot more! They don't organise frontend and npm vuln that way. This doesn't even mention JavaScript:

            https://www.cve.org/CVERecord?id=CVE-2025-3573

            The search relies on descriptions for which standard terms are "an ongoing area of research" 🧐

            https://www.cve.org/ResourcesSupport/FAQs#pc_cve_list_basicssearch_cve

            1. Timo Tijhof 1 day later

               @zachleat

               Eco diff is quite distorted.

               CVE dedupes npm such that A using outdated B isn't its own vul, despite requiring a separate upstream fix, and npm pkgs often having deep and wide dep trees (1000+ is common), and npm installing multiple versions, thus end-users don't update just once. You wait to apply each.

               WP pgks are global so a thing only updates once (like Linux). Most have 0 deps, some 1. The deps that exist commit to pubic API forever stable, so direct upgrade is not constrained.

               1. Private reply 1 day later
                  1. Private reply 1 day later
                     1. Private reply 1 day later
6. benschwarz 4 hr later

   @zachleat It's proof that the JS Illuminati/Israeli lobbyist group aren't quite as big or as popular as they like to pretend to be