FancyPost – Post Blocks, Grids & Sliders for Block Editor and Elementor Security & Risk Analysis

The 'post-block' plugin version 6.0.1 presents a mixed security posture. While it demonstrates good practices such as using prepared statements for all SQL queries and a significant number of nonce and capability checks, there are notable areas of concern. The presence of two AJAX handlers without authentication checks creates a direct attack surface for unauthorized actions. Furthermore, the taint analysis revealing one unsanitized path, even without a critical or high severity, indicates a potential for code injection or data leakage that warrants attention.

The vulnerability history for this plugin is a significant red flag, with three known CVEs, one of which remains unpatched. The common vulnerability types of Cross-site Scripting and Missing Authorization, particularly in conjunction with the unprotected AJAX endpoints, suggest a recurring pattern of insecure handling of user input and access control. The fact that the last vulnerability was in April 2025, and it's still unpatched, implies a lack of timely security maintenance and remediation. While the plugin has strengths in its query sanitization and some security checks, the unpatched vulnerability and the unprotected entry points significantly elevate the overall risk.