Blocks – Reusable Content, Shortcodes & Site Variables Security & Risk Analysis

The "blocks" plugin v026.02.22.22 exhibits a mixed security posture. While it demonstrates good practices such as a relatively low attack surface and a decent percentage of properly escaped output, there are notable areas of concern. The presence of one unprotected REST API route represents a significant potential entry point for unauthorized actions. Furthermore, the fact that half of its SQL queries are not using prepared statements raises alarms for potential SQL injection vulnerabilities, especially when combined with the unprotected REST API. The plugin's vulnerability history, specifically a past medium-severity Cross-Site Scripting (XSS) vulnerability, suggests a tendency for input sanitization issues. Although this vulnerability is currently patched, it highlights a pattern that, when combined with the static analysis findings, warrants caution.

In conclusion, the plugin has strengths in its limited external dependencies and generally good output escaping. However, the unprotected REST API route and the prevalence of non-prepared SQL statements are critical weaknesses that significantly elevate the risk profile. The historical XSS vulnerability reinforces the need for rigorous input validation and sanitization. Users of this plugin should be aware of these potential vulnerabilities and ensure they are using the latest patched version, while actively monitoring for any future security advisories.