Unlimited Addons For Gutenberg Blocks Security & Risk Analysis

The unlimited-blocks plugin v1.2.8 exhibits a concerning security posture primarily due to a significant number of unprotected entry points. All 28 AJAX handlers and 4 REST API routes lack authentication checks, exposing a large attack surface to potential unauthorized access and manipulation. While the static analysis highlights excellent practices in preventing SQL injection and ensuring proper output escaping, the complete absence of nonce and capability checks on these numerous entry points creates a critical vulnerability. The vulnerability history, with one unpatched medium severity Cross-Site Scripting (XSS) vulnerability from September 16, 2024, further underscores the risk of input sanitization issues and the potential for attackers to leverage the unprotected entry points to execute malicious scripts. This pattern suggests a recurring weakness in securing user-submitted data. Despite the strong foundation in secure coding for SQL and output, the lack of fundamental access control on its entry points is a major concern, indicating a high risk of exploitation.