Qubely – Advanced Gutenberg Blocks Security & Risk Analysis

The Qubely plugin version 1.8.14 exhibits a mixed security posture. While it demonstrates good practices in areas like SQL query preparation and output escaping, significant concerns arise from its attack surface, particularly its unprotected entry points. The plugin exposes 10 out of 13 total entry points (AJAX handlers and REST API routes) without proper authentication or permission checks, creating a substantial risk for unauthorized access and potential malicious actions. The taint analysis found no critical or high severity unsanitized flows, which is a positive indicator, but the lack of authorization checks on so many entry points can allow attackers to reach vulnerable code paths that might not be apparent in static analysis alone.

The plugin's vulnerability history is deeply concerning, with 9 known medium severity CVEs, two of which remain unpatched. The recurring nature of vulnerabilities, including Missing Authorization and Cross-site Scripting, coupled with the recent discovery of flaws in late 2025, suggests a pattern of security weaknesses that the development team has struggled to consistently address. The presence of unpatched vulnerabilities, even at a medium severity, poses an immediate risk to users. While the plugin has strengths in certain secure coding practices, the high number of unprotected entry points and the persistent vulnerability history present a significant security risk that warrants careful consideration and prompt patching.