BlockSpare — News, Magazine and Blog Addons for (Gutenberg) Block Editor Security & Risk Analysis

The 'blockspare' plugin v3.3.0 demonstrates a generally good security posture with several strong practices in place. The static analysis reveals a limited attack surface with all identified entry points (AJAX handlers and REST API routes) having authentication checks. The code also shows diligent use of prepared statements for SQL queries and a high percentage of properly escaped output, minimizing risks of SQL injection and cross-site scripting from direct code vulnerabilities. Nonce and capability checks are frequently implemented, indicating an awareness of common WordPress security measures. However, a significant concern arises from the taint analysis, which identified two flows with unsanitized paths. While no critical or high severity issues were reported from these, unsanitized paths can often lead to exploitable vulnerabilities if not handled carefully, especially in conjunction with external HTTP requests.

The plugin's vulnerability history is a major red flag. With six known CVEs, all of medium severity, and a recent vulnerability reported in October 2025, this pattern suggests a recurring issue with maintaining a secure codebase. The common vulnerability types of "Exposure of Sensitive Information to an Unauthorized Actor" and "Cross-site Scripting" are particularly worrying. Although currently there are no unpatched CVEs, the sheer volume of past vulnerabilities, even if medium severity, indicates a potential for future undiscovered issues or a struggle with robust security across all code paths. The presence of an outdated bundled library (Freemius v1.0) is also a minor concern that could be addressed.

In conclusion, while 'blockspare' v3.3.0 has commendable defensive coding practices in place, the identified unsanitized paths in taint analysis and a concerning history of medium-severity vulnerabilities necessitate careful consideration. The plugin's strengths lie in its protected entry points and proper SQL handling, but the recurring vulnerability types and the presence of unsanitized data flows present a notable risk that should be closely monitored and potentially mitigated.