PublishPress Blocks – Block Controls, Block Visibility, Block Permissions Security & Risk Analysis

The "advanced-gutenberg" v3.6.2 plugin presents a mixed security posture. While it demonstrates good practices in output escaping (94% properly escaped) and has a substantial number of nonce and capability checks (27 and 34 respectively), significant concerns arise from its attack surface and historical vulnerability patterns. The presence of 15 AJAX handlers, with 2 lacking authentication checks, and 5 REST API routes without explicit permission callbacks, creates potential entry points for unauthorized actions.

Static analysis reveals 2 flows with unsanitized paths, indicating a potential risk of directory traversal or other file-related vulnerabilities, though no critical or high severity taint flows were found. The plugin's vulnerability history is a more alarming indicator, with 3 known CVEs, including one critical and two medium, primarily related to PHP Remote File Inclusion and Cross-site Scripting. The fact that the last vulnerability was in late 2025 (though this is a future date and likely a data anomaly) and that there are currently no unpatched vulnerabilities is a positive sign, but the recurring nature of these vulnerability types suggests a recurring weakness in input sanitization and file handling.

In conclusion, while the plugin shows some strengths in output handling and checks, the significant unprotected entry points and a history of critical and medium vulnerabilities, particularly RFI and XSS, warrant careful consideration. The identified unsanitized path flows, though not currently critical, could be exploited in conjunction with the unprotected entry points.