ZoloBlocks – Advanced Gutenberg Blocks, Website Builder & Page Design Toolkit Security & Risk Analysis

The zoloblocks plugin v2.7.0 presents a mixed security posture. On the positive side, the plugin demonstrates good practices regarding SQL query handling, with 100% of queries using prepared statements. Output escaping is also robust, with 97% of outputs properly handled. File operations and dangerous function usage are notably absent, and a substantial number of nonce and capability checks are implemented, indicating an awareness of security fundamentals.

However, significant concerns arise from the attack surface. Two AJAX handlers lack authentication checks, creating a direct pathway for unauthorized actions. While REST API routes are properly permissioned, the presence of unprotected AJAX endpoints is a critical flaw. The taint analysis revealed two flows with unsanitized paths, which, although not reaching critical or high severity in this specific scan, warrant attention as they represent potential avenues for exploitation if input validation is insufficient.

The vulnerability history is a major red flag. With a total of six known CVEs, including two high and four medium severity issues, the plugin has a pattern of security weaknesses. Common vulnerability types such as missing authorization, SSRF, XSS, and RFI suggest recurring problems with input sanitization and access control. The fact that the last vulnerability was reported in late 2025, and there are currently no unpatched CVEs, is a positive sign for this specific version, but the historical prevalence of severe issues necessitates caution and continuous monitoring.