Blockons – Gutenberg blocks for WordPress and WooCommerce websites Security & Risk Analysis

The blockons plugin v1.2.15 presents a mixed security posture. On the positive side, it demonstrates good practices with 100% of SQL queries using prepared statements and 99% of output properly escaped. The absence of dangerous functions and critical/high taint flows is also encouraging. However, significant concerns arise from its vulnerability history and exposed attack surface. The plugin has a history of two medium-severity vulnerabilities, including Cross-Site Scripting and Missing Authorization, with both currently unpatched. This suggests a recurring pattern of security weaknesses that attackers could exploit. Furthermore, the plugin exposes two REST API routes without permission callbacks, indicating a potential for unauthorized access or actions to be performed. While the use of nonces and capability checks is present, the two unprotected entry points, specifically within the REST API, are a direct security risk. The presence of a bundled library (Freemius v1.0) without version information introduces a potential for known vulnerabilities within that dependency. In conclusion, while the plugin has some strong security fundamentals in its code, the unpatched vulnerabilities and exposed API endpoints create a notable risk that requires immediate attention.