This plugin https://wiki.jenkins-ci.org/display/JENKINS/Managed+Script+Plugin allows you to save scripts as managed entities in jenkins.
These are not in the repo that the scm-sync plugin manages.
I do not know where these files are stores, only that this is a vulnerability as they are not being committed to git along with the rest of the config.