Spice Blocks

Spice Blocks has 3 disclosed vulnerabilities in the WordSec catalog, reported between 2023 and 2025; 2 are fixed and 1 remains unpatched as of September 2026. Their average CVSS score is 6.3, and the most serious one scores 7.5 out of 10. Severity breakdown: 0 critical and 1 high. 2025 was the busiest year with 2 disclosures.

The most common weakness is Cross-Site Scripting, behind 1 of the records (33%). Other recurring categories include Missing Authorization, Path Traversal.

2 of the records (67%) have a vendor fix, while 1 remain unpatched. The oldest unresolved one dates back to 2025.

3 independent researchers contributed these findings, one record each. Spice Blocks is installed on roughly 1,000 WordPress sites, so each unpatched flaw has a wide blast radius. The current release is tested up to WordPress 6.9.7.

Strategic Overview

Avg CVSSMedium

6.3/ 10

Patch Coverage67%

Open

Fixed

Get automatic notifications for all Spice Blocks vulnerabilities before they are exploited.

Most severe open issueCVSS 5.3CVE-2025-39532

Spice Blocks <= 2.0.7.4 - Missing Authorization

Read the full analysis

Vulnerability Records

3 records


2025-06-04 00:00	Spice Blocks <= 2.0.7.4 - Unauthenticated Arbitrary File Download Spice Blocks <= 2.0.7.4	`CVE-2025-48130`	7.5 High	Martino Spagnuolo	Yes
2025-04-17 00:00	Spice Blocks <= 2.0.7.4 - Missing Authorization Spice Blocks <= 2.0.7.4	`CVE-2025-39532`	5.3 Medium	0xd4rk5id3	No
2023-07-18 00:00	Freemius SDK <= 2.5.9 - Reflected Cross-Site Scripting via fs_request_get Spice Blocks 0.3 – 1.2.1	`CVE-2023-33999`	6.1 Medium	Rafie Muhammad	Yes

Showing 1–3 of 3 reports

Plugin Profile

Latestv2.0.7.7

Spice Blocks

Author

spicethemes

0.0(0)

0/100

Last Updated

2026-02-09 (7mo ago)

Active Installs

1,000+

Downloads

19,072

Requires WP

5.3+

Requires PHP

5.2+

Tested up to

WP 6.9.7

Created

2022-12-05 (4y ago)

Spice Blocks Plugin is a block plugin that is compatible with all WordPress themes. In plugin block controls are given, that’s help to develop a beautiful WordPress theme. Key Features Heading Editor Divider Button Spacer Icon Section Column Image Blockquote Call To Action Timeline Accordion Icon List Image Comparison Image Gallery Image Accordion Progress Bar Service Box Social Icons News Filter Posts Star Rating External Resources Font Awesome: Copyright: (c) Dave Gandy License: https://fontawesome.com/license ( Icons: CC BY 4.0, Fonts: SIL OFL 1.1, Code: MIT License ) Source: https://fontawesome.com Animate: Copyright: (c) 2017 Daniel Eden License: MIT License Source: https://github.com/daneden/animate.css Image Comparison Viewer: Copyright (c) 2020 Kyle Wetton License: MIT License Source:https://github.com/kylewetton/image-compare-viewer React Font Icon Picker: Copyright (c) 2018 Swashata Ghosh swashata@wpquark.com License: MIT License Source:https://github.com/fontIconPicker/react-fonticonpicker Images Image used in Blockquote License CC0 Public Domain https://pxhere.com/en/photo/588308?__cf_chl_tk=w8.ACXm4RWQ39fiMGdMhAUfBVMxGWOGzAuUp8uYkMKk-1668584178-0-gaNycGzNC9E Image used in Call to Action License CC0 Public Domain https://pxhere.com/en/photo/913890 Image used in Service License CC0 Public Domain https://pxhere.com/en/photo/1573331 Images on /assets/images folder Copyright (C) 2022, spicethemes and available as GPLv2

View on WordPress.org