WP Manifestindependent plugin directory
manifest / editor / ctx-blocks

CTX Blocks WP Registry grade D+. High-severity findings · 2 findingsWP RegistryHigh-severity findings · 2 findingsOpen the reportD+

Twig fueled Gutenberg blocks

★ 8stars
38release downloads
v3.1.9latest · 1 year ago

Install

Download ctx-blocks.zip From the v3.1.9 release on GitHub, May 28, 2025

Upload it under Plugins → Add New Plugin → Upload Plugin, then activate.

Install straight from GitHub with WP-CLI:

wp plugin install https://github.com/gollenia/ctx-blocks/releases/download/v3.1.9/ctx-blocks.zip
No built-in updater. New versions won't appear under Dashboard → Updates. Install new releases yourself, or let Git Updater track the repository.

CTX Blocks is a Wordpress Gutenberg Plugin. It includes some new blocks that come in handy for generic websites

Description

CTX Blocks is built to extend the Gutenberg editor with practical, versatile blocks tailored for real-world use. Whether you're building landing pages, internal tools, or dynamic content sections, CTX Blocks equips you with components that are both intuitive for editors and flexible for developers.

It is developed with a focus on clean design, mobile responsiveness, and modern frontend practices (TailwindCSS, BEM, React where needed). Most blocks are customizable via block settings and CSS classes, and follow semantic HTML wherever possible.

New Blocks

  • Grid – Create responsive grid layouts with flexible column control for each screen size. Columns can be reordered on smaller devices.

  • Card – A customizable card component with support for labels, badges, shadows, and color settings.

  • Description List – A stylish list block with optional icons or images, captions, and descriptions.

  • Buttons – A button block that supports links, JavaScript functions, and modal triggers.

  • Conditional – Conditionally display content depending on date and time (more conditions planned).

  • Progress – A progress bar for donations, project stats, or any other use case.

  • Image - An alternative image-block that adds more options (round images, shadow, etc)

  • SVG – Embed SVG graphics directly into the content.

Installation

You’ll need SSH access and an installed npm environment. Then run the following commands to clone and build the plugin:

git clone https://github.com/gollenia/ctx-blocks.git
cd ctx-blocks
npm install
npm run build

Feel free, of course, to make use of GitHub's actions ;-)

Changelog

3.1.1
  • Progress Bar fix
3.1
  • NPM Packages Version Dump
3.0
  • Upgraded to Block API 3.0
  • Image Block reworked
2.0
  • Removed all Timber stuff and render most blocks through react
  • Removed alert, image, modal, header, footer, button-group, button-spacer, topbar, posts
  • Added SVG Block
  • Support for Wordpress 6.4
  • Make use of new Block registration System via block.json
1.9.1
  • Bring back text align justify
1.9
  • Adaptions to Wordpress 6
  • New blocks (section, header) for the template editor
  • Section gets deprecated for Groups
1.8.1
  • Image can now have a link
  • Some translations fixed
  • More blocks moved to BEM-Style
  • Cards with links can now have child links
1.8
  • New base block to force editors to use sections at base level
  • Redesigned Editor UI makes it easier to identify blocks
  • Description list improved
  • Some CSS moved to BEM Style (not all, yet)
  • Most blocks use useInnerBlocksProps() hook now
1.7
  • Rewritten block registration to fit new block.json style and make it compatible with future Wordpress versions
  • Added spacer block to button-group
  • Many bug fixes
  • Grid and buttons now make use of the new useInnerBlocksProps() hook
  • All core blocks now have a "core-block" class for easier css
1.6
  • All templates now use BEM-based classes
  • JavaScript for basic frontend functionality is now included
  • Modal block has been included into the button
  • Button can now have icon
  • description list and progress bar completely rewritten
  • The plugin now disables the standard wordpress Blocks like columns or image
  • A lot of bugfixes
1.5.2
  • minor buffixes
  • card has now hover attribute
  • twig templates updated
1.5.1
  • core/spacer now has auto-height feature for equalizing cards
  • cards now support button-groups
  • visibility switch has tailwind classes
1.5
  • Cards now support labels and badges
  • New Block: Button Group
  • Normal buttons now support modals (modals block will be removed in 1.6)
  • Removed global block classes
  • Moved from Tailwind to component driven classes
1.4
  • Upgraded to timber 2.0a
  • removed Accordion-Blocks
  • Progress bar completely rewritten
1.3
  • Upgraded all Blocks to ApiVersion 2.0
  • Added language Support
  • New Block: Navigation
  • New Block: Posts
1.2
  • New Block: Modal
1.1
  • Introduced Twig
  • Moved from uiKit to Tailwindcss
1.0

Initial release

Releases

7 releases. Each count is every asset in that release; expand a row for the breakdown.

Tag
Published
Assets
Downloads
v3.1.9 latest
May 28, 2025 1 year ago
ctx-blocks.zip
14
May 5, 2025 1 year ago
ctx-blocks.zip
9
May 5, 2025 1 year ago
ctx-blocks.zip
1
May 2, 2025 1 year ago
ctx-blocks.zip
3
Apr 1, 2025 1 year ago
ctx-blocks.zip
1
Mar 26, 2025 1 year ago
ctx-blocks.zip
3
Mar 26, 2025 1 year ago
ctx-blocks.zip
7
D+ grade

Security

CTX Blocks 3.1.9 · audited by WP Registry

High-severity findings.

2 high
Audited release
3.1.9
Findings
2
Worst severity
high
Content hash
7e06ff3f0498cfb5e3ab6fad…

Findings

  • high Stored XSS in button block via unescaped URL and scriptTarget

    xss_stored

    ctx-blocks/button is a dynamic block (save returns InnerBlocks.Content / null; render.php emits the markup). url is concatenated into href="..." with no esc_url/esc_attr, and scriptTarget is concatenated into a footer <script> as document.getElementById("{scriptTarget}")?.{command}. The inspector exposes a Script behaviour with a free-text Element ID field (toggle/show/hide). filter_block_kses / wp_kses on users without unfiltered_html only HTML-filters attribute strings; it does not strip javascript: from a bare JSON string, nor quotes inside a JS string. A Contributor can set script=toggle and scriptTarget to x");alert(document.domain);// (or url to " onclick="alert(document.domain) or javascript:alert(document.domain)) in a pending post. When an Author publishes, or an administrator previews/reviews, the payload runs in the site origin (cookie/nonce theft, privilege escalation). title/icon/modalTitle are also echoed unescaped (kses mitigates HTML tags there, not the href/JS sinks). Not reachable by Subscriber.

    build/blocks/button/render.php:4-26,48-56

    Recommendation

    Pass url through esc_url() (and only output href on <a>). Allowlist script to toggle|show|hide|scroll and allowlist scriptTarget to a CSS/HTML id token (/^[A-Za-z][\w:-]*$/), then json_encode it into the script. Escape title/icon/modalTitle with esc_html(). Do not echo attacker-controlled strings inside <script>.

  • high Stored XSS in SVG block via raw attachment inlining and unescaped linkUrl

    xss_stored

    svg/render.php loads get_attached_file($attributes['id']) and echoes file_get_contents($path) with no mime/extension check, no SVG sanitizer, and no escaping. Any attachment the site will serve — including Author-uploaded text/plain .txt/.csv that WordPress allows by default — is injected into the page as HTML, so a file containing <script> or <svg onload=...> executes for every visitor. linkUrl is printed into <a href> without esc_url/esc_attr (javascript: and " onclick=" breakout survive kses on the JSON string). fillColor/strokeColor are interpolated into a <style> block unescaped. Independently, the editor (build/index.js) does fetch(attributes.url).then(text => dangerouslySetInnerHTML), so a Contributor can point url at a CORS-enabled payload and XSS whoever opens the post in Gutenberg. id is a number so this is not path traversal, but it is arbitrary inlining of any attachment. Requires edit_posts (linkUrl/editor fetch) or upload_files (malicious text attachment). Not reachable by Subscriber.

    build/blocks/svg/render.php:1-6,36-47

    Recommendation

    Verify the attachment is image/svg+xml (wp_check_filetype / get_post_mime_type) and sanitize the SVG (allowlist elements/attributes, strip script, event handlers, foreignObject, external refs) before echo. Escape linkUrl with esc_url() and fill/stroke colors with a CSS color allowlist or sanitize_hex_color(). In the editor, do not fetch arbitrary URLs into dangerouslySetInnerHTML; only load same-origin attachments after the same sanitizer.

WP Registry hashes the installable build and reports on that exact bytes-for-bytes copy. Embargoed findings are withheld until they are disclosed, so a clean verdict means nothing public is outstanding. WP Manifest does not audit code itself.