Responsive Blocks – Page Builder for Blocks & Patterns Security & Risk Analysis

The "responsive-block-editor-addons" plugin v2.2.3 exhibits a mixed security posture. While it demonstrates strong adherence to secure coding practices such as 100% prepared statement usage for SQL queries and nearly all output being properly escaped, there are notable areas of concern. The presence of 5 unprotected entry points across AJAX handlers and REST API routes represents a significant attack surface that could be exploited if vulnerabilities exist within those specific handlers or routes. The plugin also has a history of 7 medium severity Cross-Site Scripting (XSS) vulnerabilities, with the most recent being in the future (2025-06-27), which is unusual and warrants further investigation. This history suggests a recurring pattern of input validation or output escaping issues that, while currently patched, could re-emerge if development practices do not fully address the root causes. The bundling of Lodash, without information on its version, also presents a potential risk if it's an outdated or vulnerable version. Overall, the plugin has good foundations in secure coding but requires vigilance regarding its unprotected entry points and historical vulnerability patterns.