Stackable – Page Builder Gutenberg Blocks Security & Risk Analysis

The plugin "stackable-ultimate-gutenberg-blocks" v3.19.7 exhibits a mixed security posture. On the positive side, the static analysis reveals no critical or high severity taint flows, and a relatively high percentage of output escaping (77%). The presence of 24 capability checks and 5 nonce checks indicates a good effort in implementing authorization and security mechanisms.

However, there are notable concerns. The presence of 7 AJAX handlers, with 2 of them lacking authentication checks, presents a significant attack surface for unauthorized actions. The code analysis also flags 2 SQL queries that do not use prepared statements, posing a risk of SQL injection. Furthermore, the plugin has a history of 7 known CVEs, all categorized as medium severity, with common vulnerability types including Cross-Site Scripting, Exposure of Sensitive Information, Missing Authorization, and Code Injection. While there are no currently unpatched vulnerabilities, this history suggests recurring security weaknesses that require ongoing attention.

In conclusion, while the latest version shows improvements in certain areas like taint flows and output escaping, the combination of unprotected entry points, raw SQL queries, and a history of medium-severity vulnerabilities warrants caution. Developers should prioritize addressing the unprotected AJAX handlers and the non-prepared SQL queries. The historical trend of vulnerabilities also suggests a need for a more robust and consistent security implementation to prevent future issues.