Content Blocks Builder – Create blocks, repeater blocks with carousel, grid, popup layouts Security & Risk Analysis

The "content-blocks-builder" v2.8.10 plugin exhibits a mixed security posture. On the positive side, it demonstrates good practices with a high percentage of properly escaped outputs and predominantly uses prepared statements for SQL queries. The absence of dangerous functions and a low number of file operations are also encouraging signs. However, a significant concern arises from the attack surface exposed through the REST API, with 10 out of 15 routes lacking proper permission callbacks. This creates a substantial opportunity for unauthorized access or manipulation if these endpoints are not adequately secured by other means.

The plugin's vulnerability history, while showing no currently unpatched CVEs, does reveal a past medium severity Cross-Site Scripting (XSS) vulnerability. The fact that the last known vulnerability was in the future (2025-01-07) might indicate an anomaly in the data or a projection rather than a historical event. The single previously disclosed CVE, even if patched, warrants continued vigilance. The taint analysis shows a flow with an unsanitized path, though it is not classified as critical or high severity, it still represents a potential weak point that could be exploited in combination with other factors.

In conclusion, while the core code quality appears solid with good sanitization and SQL practices, the unprotected REST API endpoints represent a primary risk. The past XSS vulnerability, though patched, should be considered. The plugin is generally well-maintained with no critical or high severity issues, but the exposed REST API routes necessitate careful consideration and potentially additional security measures to mitigate risks.