Frontis Blocks — Block Library for the Block Editor Security & Risk Analysis

The "frontis-blocks" plugin v1.1.9 exhibits a mixed security posture. On the positive side, the plugin demonstrates strong practices in core areas like SQL query sanitization (93% prepared statements) and output escaping (98% properly escaped), minimizing the risk of common vulnerabilities like SQL injection and XSS. The presence of a good number of nonce and capability checks also suggests an awareness of WordPress security best practices.

However, significant concerns arise from the attack surface analysis. With 5 unprotected entry points out of 11 total, specifically from the REST API routes, there's a clear risk of unauthorized access or manipulation. The taint analysis further amplifies these concerns, revealing 3 high-severity flows with unsanitized paths and 8 flows with unsanitized paths in total. This indicates potential avenues for code injection or data leakage that have not been adequately mitigated.

The vulnerability history, although currently showing no unpatched CVEs, reveals a pattern of past high and medium severity vulnerabilities, notably Server-Side Request Forgery (SSRF). The existence of two prior CVEs and a recent one in 2026 (likely a typo, but indicative of historical issues) suggests a recurring need for robust security development and thorough code auditing within this plugin. While the current version might be clean, past issues and identified taint flows warrant caution.