Stackable – Page Builder Gutenberg Blocks Security & Risk Analysis

wordpress.org/plugins/stackable-ultimate-gutenberg-blocks

Custom Blocks that transform your WordPress Block Editor into a page builder

100K active installs v3.19.7 PHP 7.3+ WP 6.6.4+ Updated Feb 25, 2026
blocksgutenberggutenberg-blockspage-builderwordpress-blocks
95
A · Safe
CVEs total7
Unpatched0
Last CVEJan 7, 2026
Safety Verdict

Is Stackable – Page Builder Gutenberg Blocks Safe to Use in 2026?

Generally Safe

Score 95/100

Stackable – Page Builder Gutenberg Blocks has a strong security track record. Known vulnerabilities have been patched promptly.

7 known CVEsLast CVE: Jan 7, 2026Updated 1mo ago
Risk Assessment

The plugin "stackable-ultimate-gutenberg-blocks" v3.19.7 exhibits a mixed security posture. On the positive side, the static analysis reveals no critical or high severity taint flows, and a relatively high percentage of output escaping (77%). The presence of 24 capability checks and 5 nonce checks indicates a good effort in implementing authorization and security mechanisms.

However, there are notable concerns. The presence of 7 AJAX handlers, with 2 of them lacking authentication checks, presents a significant attack surface for unauthorized actions. The code analysis also flags 2 SQL queries that do not use prepared statements, posing a risk of SQL injection. Furthermore, the plugin has a history of 7 known CVEs, all categorized as medium severity, with common vulnerability types including Cross-Site Scripting, Exposure of Sensitive Information, Missing Authorization, and Code Injection. While there are no currently unpatched vulnerabilities, this history suggests recurring security weaknesses that require ongoing attention.

In conclusion, while the latest version shows improvements in certain areas like taint flows and output escaping, the combination of unprotected entry points, raw SQL queries, and a history of medium-severity vulnerabilities warrants caution. Developers should prioritize addressing the unprotected AJAX handlers and the non-prepared SQL queries. The historical trend of vulnerabilities also suggests a need for a more robust and consistent security implementation to prevent future issues.

Key Concerns

  • 2 AJAX handlers without auth checks
  • 2 SQL queries without prepared statements
  • 7 medium severity CVEs in history
  • 77% output escaping (23% not escaped)
Vulnerabilities
7

Stackable – Page Builder Gutenberg Blocks Security Vulnerabilities

CVEs by Year

3 CVEs in 2024
2024
3 CVEs in 2025
2025
1 CVE in 2026
2026
Patched Has unpatched

Severity Breakdown

Medium
7

7 total CVEs

CVE-2025-47500medium · 6.4Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Stackable <= 3.19.5 - Authenticated (Author+) Stored Cross-Site Scripting

Jan 7, 2026 Patched in 3.19.6 (26d)
CVE-2025-60095medium · 4.3Exposure of Sensitive Information to an Unauthorized Actor

Stackable <= 3.18.1 - Authenticated (Contributor+) Sensitive Information Exposure

Sep 26, 2025 Patched in 3.19.0 (7d)
CVE-2025-60094medium · 4.3Missing Authorization

Stackable <= 3.18.1 - Missing Authorization

Sep 26, 2025 Patched in 3.19.0 (7d)
CVE-2024-12117medium · 6.4Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Stackable – Page Builder Gutenberg Blocks <= 3.13.11 - Authenticated (Contributor+) Stored Cross-Site Scripting

Jan 21, 2025 Patched in 3.13.12 (1d)
CVE-2024-8760medium · 5.3Improper Control of Generation of Code ('Code Injection')

Stackable – Page Builder Gutenberg Blocks <= 3.13.6 - Unauthenticated CSS Injection

Oct 11, 2024 Patched in 3.13.7 (1d)
CVE-2024-6296medium · 6.4Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Stackable – Page Builder Gutenberg Blocks <= 3.13.1 - Authenticated (Contributor+) DOM-Based Stored Cross-Site Scripting

Jun 27, 2024 Patched in 3.13.2 (1d)
CVE-2024-2039medium · 6.4Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Stackable – Page Builder Gutenberg Blocks <= 3.12.11 - Authenticated(Contributor+) Stored Cross-Site Scripting via Posts Block

Mar 28, 2024 Patched in 3.12.12 (126d)
Code Analysis
Analyzed Mar 16, 2026

Stackable – Page Builder Gutenberg Blocks Code Analysis

Dangerous Functions
0
Raw SQL Queries
2
0 prepared
Unescaped Output
25
84 escaped
Nonce Checks
5
Capability Checks
24
File Operations
2
External Requests
4
Bundled Libraries
1

Bundled Libraries

Freemius

SQL Query Safety

0% prepared2 total queries

Output Escaping

77% escaped109 total outputs
Data Flows
All sanitized

Data Flow Analysis

2 flows
ajax_update_disable_blocks (src\deprecated\v2\disabled-blocks.php:58)
Source (user input) Sink (dangerous op) Sanitizer Transform Unsanitized Sanitized
Attack Surface
2 unprotected

Stackable – Page Builder Gutenberg Blocks Attack Surface

Entry Points17
Unprotected2

AJAX Handlers 7

authwp_ajax_stackable_notice_gutenberg_plugin_ignoreplugin.php:165
authwp_ajax_stackable_update_disable_blocks_v2src\deprecated\v2\disabled-blocks.php:27
authwp_ajax_stackable_news_feed_ajaxsrc\welcome\news.php:141
authwp_ajax_stackable_dismiss_noticesrc\welcome\notification.php:19
authwp_ajax_stackable_useful_plugins_activatesrc\welcome\useful-plugins.php:30
authwp_ajax_stackable_useful_plugins_installsrc\welcome\useful-plugins.php:31
authwp_ajax_stackable_check_cimo_statussrc\welcome\useful-plugins.php:34

REST API Routes 10

GET/wp-json/stackable/v3/termssrc\block\posts\index.php:240
GET/wp-json/stackable/v3/get_postssrc\block\posts\index.php:247
GET/wp-json/stackable/v2/editor_mode_get_all_postssrc\components\__experimental-multi-post-picker-control\index.php:30
POST/wp-json/stackable/v2/update_block_stylesrc\deprecated\block-defaults\custom-block-styles.php:113
POST/wp-json/stackable/v2/delete_block_stylesrc\deprecated\block-defaults\custom-block-styles.php:138
GET/wp-json/stackable/v2/termssrc\deprecated\v2\block\blog-posts\index.php:708
GET/wp-json/stackable/v2/block_designs/(?P<block>[\w\d-]+)src\deprecated\v2\design-library\init.php:70
GET/wp-json/stackable/v2/design_library/(?P<type>[\w]+)(?:/(?P<reset>reset))?src\design-library\init.php:62
POST/wp-json/stackable/v3/design_library_imagesrc\design-library\init.php:77
GET/wp-json/stackable/v3/get_theme_fontssrc\fonts.php:60
WordPress Hooks 207
actionadmin_noticesplugin.php:91
actionadmin_menuplugin.php:113
actioninitplugin.php:132
actionadmin_noticesplugin.php:157
actionadmin_noticesplugin.php:188
actionrest_api_initsrc\admin.php:22
actionstackable/accordion/enqueue_scriptssrc\block\accordion\index.php:20
actionstackable/accordion/enqueue_scriptssrc\block\accordion\index.php:65
filterrender_block_stackable/accordionsrc\block\accordion\index.php:73
filterwp_footersrc\block\accordion\index.php:74
actionstackable/carousel/enqueue_scriptssrc\block\carousel\index.php:20
filterrender_block_stackable/columnssrc\block\columns\index.php:23
actionstackable/count-up/enqueue_scriptssrc\block\count-up\index.php:20
actionstackable/countdown/enqueue_scriptssrc\block\countdown\index.php:20
actionstackable/expand/enqueue_scriptssrc\block\expand\index.php:20
actionstackable/horizontal-scroller/enqueue_scriptssrc\block\horizontal-scroller\index.php:20
filterrender_block_stackable/icon-labelsrc\block\icon-label\deprecated.php:36
actionstackable/map/enqueue_scriptssrc\block\map\index.php:24
actionstackable/notification/enqueue_scriptssrc\block\notification\index.php:20
filterstackable.register-blocks.optionssrc\block\posts\index.php:229
actionrest_api_initsrc\block\posts\index.php:230
filtersharing_showsrc\block\posts\index.php:407
actionstackable/progress-bar/enqueue_scriptssrc\block\progress-bar\index.php:20
filterrender_block_stackable/progress-barsrc\block\progress-bar\index.php:39
actionstackable/progress-circle/enqueue_scriptssrc\block\progress-circle\index.php:20
filterrender_block_stackable/progress-circlesrc\block\progress-circle\index.php:39
filterrank_math/researches/toc_pluginssrc\block\table-of-contents\index.php:12
actionstackable/tabs/enqueue_scriptssrc\block\tabs\index.php:20
filterrender_block_stackable/timelinesrc\block\timeline\index.php:23
actionstackable/video-popup/enqueue_scriptssrc\block\video-popup\index.php:20
filterrender_block_stackable/video-popupsrc\block\video-popup\index.php:28
filterwp_footersrc\block\video-popup\index.php:29
filterrender_blocksrc\block-components\alignment\index.php:66
filterrender_blocksrc\block-components\alignment\index.php:147
actioninitsrc\blocks.php:42
filterexcerpt_allowed_wrapper_blockssrc\blocks.php:86
filterexcerpt_allowed_blockssrc\blocks.php:118
filterstackable.global-settings.global-color-schemes.add-theme-compatibilitysrc\compatibility\blocksy\index.php:89
filterstackable.design-library.global-theme-stylessrc\compatibility\blocksy\index.php:193
actionstackable/enqueue_scriptssrc\compatibility\ewww.php:29
actionplugins_loadedsrc\compatibility\ewww.php:36
filterstackable_dynamic_content/get_dynamic_content/idsrc\compatibility\neve\index.php:17
filterstackable_dynamic_content/parse_field_data/current_post_idsrc\compatibility\neve\index.php:29
filterpre_ksessrc\compatibility\woocommerce.php:28
actionwoocommerce_before_main_contentsrc\compatibility\woocommerce.php:33
filterstackable/load_cached_css_for_postsrc\compatibility\woocommerce.php:44
filterstackable/get_post_id_for_cached_csssrc\compatibility\woocommerce.php:58
actionrest_api_initsrc\components\__experimental-multi-post-picker-control\index.php:23
actionsave_postsrc\css-optimize.php:78
actionwpsrc\css-optimize.php:85
filterrender_blocksrc\css-optimize.php:89
filteris_protected_metasrc\css-optimize.php:94
actionwp_headsrc\css-optimize.php:223
actionadmin_initsrc\deprecated\block-defaults\custom-block-styles.php:25
actionrest_api_initsrc\deprecated\block-defaults\custom-block-styles.php:26
actionrest_api_initsrc\deprecated\block-defaults\custom-block-styles.php:29
actionadmin_initsrc\deprecated\block-defaults\custom-block-styles.php:33
actionrest_api_initsrc\deprecated\block-defaults\custom-block-styles.php:34
actioncurrent_screensrc\deprecated\block-defaults\custom-block-styles.php:37
actionadmin_initsrc\deprecated\block-defaults\custom-block-styles.php:42
filterstackable_js_settingssrc\deprecated\block-defaults.php:35
actioninitsrc\deprecated\block-defaults.php:36
actionstackable_early_version_upgradedsrc\deprecated\block-defaults.php:62
actioninitsrc\deprecated\block-defaults.php:63
actionadmin_initsrc\deprecated\editor-settings.php:33
actionstackable_early_version_upgradedsrc\deprecated\font-awesome-version.php:26
actionstackable_early_version_upgradedsrc\deprecated\global-color-schemes.php:35
filterrender_blocksrc\deprecated\native-global-colors.php:32
actionadmin_initsrc\deprecated\native-global-colors.php:49
actionrest_api_initsrc\deprecated\native-global-colors.php:50
actioninitsrc\deprecated\native-global-colors.php:116
actionwp_footersrc\deprecated\native-global-colors.php:117
actionstackable_early_version_upgradedsrc\deprecated\navigation-panel-pre-enabled.php:26
filterstackable_block_migrate_attributes_v2src\deprecated\v2\block\blog-posts\deprecated.php:106
filterstackable/blog-posts/v2/edit.output.markupsrc\deprecated\v2\block\blog-posts\deprecated.php:158
filterstackable.v2.register-blocks.optionssrc\deprecated\v2\block\blog-posts\index.php:396
actionrest_api_initsrc\deprecated\v2\block\blog-posts\index.php:475
filtersharing_showsrc\deprecated\v2\block\blog-posts\index.php:577
filterrender_block_ugb/blog-postssrc\deprecated\v2\block\blog-posts\index.php:650
actionrest_api_initsrc\deprecated\v2\block\blog-posts\index.php:717
actioninitsrc\deprecated\v2\blocks.php:147
actioninitsrc\deprecated\v2\blocks.php:151
actionenqueue_block_editor_assetssrc\deprecated\v2\blocks.php:155
filterexcerpt_allowed_wrapper_blockssrc\deprecated\v2\blocks.php:183
filterexcerpt_allowed_blockssrc\deprecated\v2\blocks.php:220
filterstackable_fetch_design_librarysrc\deprecated\v2\design-library\init.php:25
actionrest_api_initsrc\deprecated\v2\design-library\init.php:28
actionstackable_delete_design_library_cachesrc\deprecated\v2\design-library\init.php:31
filterstackable_localize_scriptsrc\deprecated\v2\disabled-blocks.php:21
filterstackable_localize_settings_scriptsrc\deprecated\v2\disabled-blocks.php:24
filterstackable_global_typography_selectorssrc\deprecated\v2\global-settings.php:19
actionstackable_version_upgradedsrc\deprecated\v2\init.php:40
actionadmin_initsrc\deprecated\v2\init.php:121
actionrest_api_initsrc\deprecated\v2\init.php:122
actioninitsrc\deprecated\v2\init.php:204
actioninitsrc\deprecated\v2\init.php:258
filterstackable_is_stackable_blocksrc\deprecated\v2\init.php:273
actionenqueue_block_assetssrc\deprecated\v2\init.php:295
filterrender_blocksrc\deprecated\v2\init.php:326
actioninitsrc\deprecated\v2\init.php:347
actionadmin_initsrc\deprecated\v2\optimization-settings.php:26
actionrest_api_initsrc\deprecated\v2\optimization-settings.php:27
actioninitsrc\deprecated\v2\optimization-settings.php:31
filterrender_blocksrc\deprecated\v2\optimization-settings.php:34
actionrest_api_initsrc\design-library\init.php:30
actionstackable_delete_design_library_cachesrc\design-library\init.php:32
filterstackable_localize_scriptsrc\design-library\init.php:34
actionadmin_initsrc\dynamic-breakpoints.php:35
actionrest_api_initsrc\dynamic-breakpoints.php:36
filterstackable_frontend_csssrc\dynamic-breakpoints.php:40
filterstackable_frontend_csssrc\dynamic-breakpoints.php:43
actionstackable_block_enqueue_frontend_assetssrc\dynamic-breakpoints.php:46
filterrender_blocksrc\dynamic-breakpoints.php:50
filterstackable_localize_settings_scriptsrc\dynamic-breakpoints.php:54
actionadmin_initsrc\editor-settings.php:16
actionrest_api_initsrc\editor-settings.php:17
filterstackable_js_settingssrc\editor-settings.php:20
actionstackable_inline_stylessrc\editor-settings.php:23
actionstackable_inline_editor_stylessrc\editor-settings.php:24
actionrest_api_initsrc\fonts.php:31
filterrender_blocksrc\fonts.php:94
filterwp_footersrc\fonts.php:156
actionadmin_initsrc\global-settings.php:51
actionrest_api_initsrc\global-settings.php:52
filterstackable_inline_styles_nodepsrc\global-settings.php:60
actionafter_setup_themesrc\global-settings.php:76
filterrender_blocksrc\global-settings.php:82
filterstackable_global_typography_selectorssrc\global-settings.php:86
filterstackable_inline_styles_nodepsrc\global-settings.php:89
actionadmin_initsrc\icons.php:22
actionrest_api_initsrc\icons.php:23
actionstackable_localize_scriptsrc\icons.php:26
actionenqueue_block_editor_assetssrc\init.php:39
filterrender_blocksrc\init.php:44
actiontemplate_redirectsrc\init.php:45
actionenqueue_block_editor_assetssrc\init.php:50
actionenqueue_block_editor_assetssrc\init.php:52
actionenqueue_block_assetssrc\init.php:56
actionplugins_loadedsrc\init.php:59
actionwp_footersrc\init.php:61
actionstackable_inline_stylessrc\init.php:65
actionstackable_inline_editor_stylessrc\init.php:66
actionbody_classsrc\init.php:69
actionadmin_body_classsrc\init.php:70
actionwp_enqueue_scriptssrc\init.php:73
actionwp_footersrc\init.php:580
actionwp_footersrc\init.php:590
filterrender_blocksrc\init.php:597
filterstackable_frontend_csssrc\init.php:598
filterrender_blocksrc\jetpack.php:71
filterwp_kses_allowed_htmlsrc\kses.php:185
actionstackable/enqueue_scriptssrc\lightbox\index.php:35
filtersafe_style_csssrc\multisite.php:43
filterwp_insert_post_datasrc\multisite.php:97
actionregister_stackable_global_settingssrc\plugins\global-settings\block-styles\index.php:25
filterstackable_inline_styles_nodepsrc\plugins\global-settings\block-styles\index.php:29
actionregister_stackable_global_settingssrc\plugins\global-settings\buttons-and-icons\index.php:23
actionstackable_early_version_upgradedsrc\plugins\global-settings\buttons-and-icons\index.php:24
filterstackable_inline_styles_nodepsrc\plugins\global-settings\buttons-and-icons\index.php:32
filterbody_classsrc\plugins\global-settings\buttons-and-icons\index.php:106
filterstackable.global-settings.global-color-schemes.default-container-schemesrc\plugins\global-settings\color-schemes\deprecated\index.php:21
actionregister_stackable_global_settingssrc\plugins\global-settings\color-schemes\index.php:30
actionstackable_early_version_upgradedsrc\plugins\global-settings\color-schemes\index.php:32
filterstackable_inline_styles_nodepsrc\plugins\global-settings\color-schemes\index.php:40
filterbody_classsrc\plugins\global-settings\color-schemes\index.php:265
filterbody_classsrc\plugins\global-settings\color-schemes\index.php:376
actionregister_stackable_global_settingssrc\plugins\global-settings\preset-controls\index.php:45
actionstackable_early_version_upgradedsrc\plugins\global-settings\preset-controls\index.php:46
actionstackable_early_version_upgradedsrc\plugins\global-settings\preset-controls\index.php:47
filterstackable_js_settingssrc\plugins\global-settings\preset-controls\index.php:48
filterstackable_inline_styles_nodepsrc\plugins\global-settings\preset-controls\index.php:50
filterstackable_inline_editor_stylessrc\plugins\global-settings\preset-controls\index.php:51
actionregister_stackable_global_settingssrc\plugins\global-settings\spacing-and-borders\index.php:23
actionstackable_early_version_upgradedsrc\plugins\global-settings\spacing-and-borders\index.php:24
filterstackable_inline_styles_nodepsrc\plugins\global-settings\spacing-and-borders\index.php:32
filterbody_classsrc\plugins\global-settings\spacing-and-borders\index.php:107
actionregister_stackable_global_settingssrc\plugins\theme-block-style-inheritance\index.php:19
actionstackable_early_version_upgradedsrc\plugins\theme-block-style-inheritance\index.php:20
actionbody_classsrc\plugins\theme-block-style-inheritance\index.php:22
filterstackable_block_style_inheritance_inline_styles_nodepsrc\plugins\theme-block-style-inheritance\index.php:23
filterstackable_js_settingssrc\plugins\theme-block-style-inheritance\index.php:25
filtersafecss_filter_attr_allow_csssrc\plugins\theme-block-style-inheritance\index.php:27
actionadmin_initsrc\pro.php:50
actionrest_api_initsrc\pro.php:51
actionadmin_menusrc\pro.php:84
actionadmin_menusrc\pro.php:85
filterstackable.blockssrc\stk-block-types.php:1138
filterrender_blocksrc\unique-id.php:47
filterfs_templates/account.php_stackable-ultimate-gutenberg-blockssrc\welcome\freemius.php:12
filterfs_/forms/affiliation.php_stackable-ultimate-gutenberg-blockssrc\welcome\freemius.php:35
filterfs_templates/contact.php_stackable-ultimate-gutenberg-blockssrc\welcome\freemius.php:58
filterfs_templates/pricing.php_stackable-ultimate-gutenberg-blockssrc\welcome\freemius.php:81
filterfs_templates/checkout.php_stackable-ultimate-gutenberg-blockssrc\welcome\freemius.php:96
actionadmin_initsrc\welcome\getting-started.php:15
actionrest_api_initsrc\welcome\getting-started.php:16
filterstackable_localize_scriptsrc\welcome\getting-started.php:19
filterstackable_localize_settings_scriptsrc\welcome\getting-started.php:20
actionadmin_menusrc\welcome\index.php:14
actionadmin_enqueue_scriptssrc\welcome\index.php:16
actionadmin_initsrc\welcome\index.php:18
actionadmin_initsrc\welcome\index.php:19
actionadmin_headsrc\welcome\index.php:21
filterfs_redirect_on_activation_stackable-ultimate-gutenberg-blockssrc\welcome\index.php:426
actionadmin_menusrc\welcome\notification-rate.php:25
filterstackable_localize_settings_scriptsrc\welcome\useful-plugins.php:37
filterstackable_localize_scriptsrc\welcome\useful-plugins.php:40
filterstackable_localize_scriptsrc\welcome\useful-plugins.php:44
Maintenance & Trust

Stackable – Page Builder Gutenberg Blocks Maintenance & Trust

Maintenance Signals

WordPress version tested6.9.4
Last updatedFeb 25, 2026
PHP min version7.3
Downloads5.2M

Community Trust

Rating98/100
Number of ratings510
Active installs100K
Developer Profile

Stackable – Page Builder Gutenberg Blocks Developer Profile

Benjamin Intal

10 plugins · 110K total installs

86
trust score
Avg Security Score
89/100
Avg Patch Time
21 days
View full developer profile
Detection Fingerprints

How We Detect Stackable – Page Builder Gutenberg Blocks

Patterns used to identify this plugin on WordPress sites during automated security audits and web crawling.

Asset Fingerprints

Asset Paths
/wp-content/plugins/stackable-ultimate-gutenberg-blocks/dist/blocks.style.build.css/wp-content/plugins/stackable-ultimate-gutenberg-blocks/dist/blocks.editor.build.css/wp-content/plugins/stackable-ultimate-gutenberg-blocks/dist/frontend.css/wp-content/plugins/stackable-ultimate-gutenberg-blocks/dist/blocks.build.js
Script Paths
/wp-content/plugins/stackable-ultimate-gutenberg-blocks/dist/blocks.build.js
Version Parameters
stackable-ultimate-gutenberg-blocks/dist/blocks.style.build.css?ver=stackable-ultimate-gutenberg-blocks/dist/blocks.editor.build.css?ver=stackable-ultimate-gutenberg-blocks/dist/frontend.css?ver=stackable-ultimate-gutenberg-blocks/dist/blocks.build.js?ver=

HTML / DOM Fingerprints

CSS Classes
stk-blockstackable-block-editor-styles-wrapper
HTML Comments
Begin StackableEnd Stackable
Data Attributes
data-block-iddata-block-typedata-block-settings
JS Globals
Stackable
FAQ

Frequently Asked Questions about Stackable – Page Builder Gutenberg Blocks