Nexter Blocks – Gutenberg Blocks, Page Builder & AI Website Builder Security & Risk Analysis

The plugin "the-plus-addons-for-block-editor" v4.7.2 exhibits a mixed security posture. While it demonstrates strong adherence to secure coding practices, such as 100% use of prepared statements for SQL queries and a high percentage of output escaping, there are significant areas of concern related to its attack surface and historical vulnerability patterns. The plugin exposes a substantial number of entry points, with 7 out of 37 (approximately 19%) lacking proper authorization checks. This includes 2 AJAX handlers and 5 REST API routes without permission callbacks, presenting a notable risk of unauthorized access and manipulation.

The static analysis reveals the presence of the `unserialize` function, which can be a vector for deserialization vulnerabilities if not handled with extreme care and sanitization. Although the taint analysis found no critical or high severity unsanitized flows, the mere presence of `unserialize` warrants careful consideration. The plugin's history of 8 medium-severity CVEs, primarily related to information exposure, XSS, and missing authorization, reinforces the existing concerns about unprotected entry points and suggests a recurring pattern of vulnerabilities in these areas. The fact that all previously discovered CVEs are patched is a positive sign, but the volume and types of past issues are still indicators of potential weaknesses.

In conclusion, while the plugin utilizes good practices for data handling (SQL, output escaping), the numerous unprotected entry points and the historical trend of authorization and XSS vulnerabilities create a tangible risk. The presence of `unserialize` further adds to this, despite current taint analysis results. Users should be particularly cautious due to the large attack surface that is not adequately protected by authorization checks. The plugin's recent vulnerability was in 2026, which is in the future, suggesting a potential data entry error. If this date is accurate, it indicates no recent vulnerabilities.