BlockStrap Page Builder – Bootstrap Blocks Security & Risk Analysis

The "blockstrap-page-builder-blocks" plugin exhibits a mixed security posture. On the positive side, the plugin demonstrates good practices regarding database interactions, utilizing prepared statements for all SQL queries and a high percentage of properly escaped output. It also includes nonce checks on its entry points and no file operations are performed, which are strong security indicators.

However, significant concerns arise from its attack surface. The plugin exposes two AJAX handlers, both of which lack authentication checks. This represents a substantial risk, as any unauthenticated user could potentially interact with these handlers and trigger unintended actions. The absence of capability checks for these entry points further exacerbates this risk. While taint analysis shows no current issues, the previous vulnerability history, including a medium-severity Cross-site Scripting (XSS) flaw, suggests a pattern of potential input validation weaknesses. The fact that the last vulnerability was in the future (2025-06-05) is likely a data anomaly, but the presence of a past medium-severity XSS is a key concern.

In conclusion, while the plugin has strengths in its handling of SQL and output escaping, the unprotected AJAX endpoints present a critical security gap. Coupled with the historical XSS vulnerability, this plugin requires careful monitoring and immediate attention to its authentication mechanisms for AJAX handlers.