Skip to content
PluginCanary

Ultimate Blocks

by Ultimate Blocks · 50,000+ active installs · Checked 4 Nov 2026
Healthy

Healthy: released 43 days ago, tested with WordPress 7.1, no open vulnerabilities.

86/ 100Healthy
Canary Score

Based on 3 of 5 areas

Sub-scores for Ultimate Blocks
Ownership100
Maintenance100
Security60
SupportNo data
ReputationNo data

How the score works

Active signals

Open issues right now, with links to the source.

  • InfoSEC-38 vulnerabilities published in the last 24 months. Review this plugin.4 Nov 2026Evidence

History: 16 past vulnerabilities, all patched. Patched issues are listed in the Security record, not here.

Quick answers

Is Ultimate Blocks still maintained?
Yes. Last release 23 Sep 2026, 40 releases in the last 24 months. 23 Sep 2026 · wordpress.org
Who owns Ultimate Blocks, and has it changed hands?
No change recorded. Main committer imtiazrayhan since Feb 2018. 4 Nov 2026 · SVN log
Was Ultimate Blocks removed from wordpress.org?
No. Listed on wordpress.org as of 4 Nov 2026. 4 Nov 2026 · wordpress.org
Is Ultimate Blocks safe?
16 known vulnerabilities, all fixed (latest in 3.3.7). Not on the exploited list. 16 Jun 2025 · Wordfence Intelligence
Is the latest Ultimate Blocks update safe to install?
No ownership change before 3.6.1. No one-star spike after it. 23 Sep 2026 · Release history

Ownership timeline

Who commits to the plugin's code on wordpress.org, over time.

Committers and their active periods
imtiazrayhan28 Feb 2018 to 23 Sep 2026, 265 commits

1 committer recorded. No ownership changes recorded since 2018.

Maintenance

Last release
43 days ago
Releases, 24 months
40
Tested up to
7.1 current
Requires PHP
7.2 supported 8.2+
Releases per quarter
Releases per quarter for Ultimate Blocks
Q1 20246
Q2 20244
Q3 20242
Q4 20244
Q1 20253
Q2 20256
Q3 20256
Q4 20257
Q1 20267
Q2 20263
Q3 20264
Q4 20260

Last release 23 Sep 2026. Tested with WordPress 7.1 (current).

Support

Resolved, last 2 months
0%
Threads, last 2 months
1

Trend appears after 8 weekly snapshots.

Security record

8 vulnerabilities in 24 months (16 on record), all patched (latest fixed in 3.3.7).

Show 16 patched vulnerabilities
DateIssueCVSSAffectedFixed inDays to patch
16 Jun 2025Authenticated (Contributor+) Stored Cross-Site Scripting6.4<= 3.3.63.3.743
9 Jun 2025Authenticated (Contributor+) Stored Cross-Site Scripting via Multiple Widgets6.4<= 3.3.33.3.4Before disclosure
19 May 2025Authenticated (Contributor+) Stored Cross-Site Scripting6.4<= 3.3.03.3.1Before disclosure
7 May 2025Authenticated (Contributor+) Stored Cross-Site Scripting6.4<= 3.2.93.3.0Before disclosure
28 Mar 2025Authenticated (Contributor+) Stored Cross-Site Scripting6.4<= 3.2.73.2.8Before disclosure
25 Mar 2025Authenticated (Contributor+) Stored Cross-Site Scripting via content Parameter6.4<= 3.2.73.2.8Before disclosure
25 Mar 2025Authenticated (Contributor+) Stored Cross-Site Scripting6.4<= 3.2.73.2.8Before disclosure
22 Nov 2024Authenticated (Contributor+) Stored Cross-Site Scripting6.4<= 3.2.33.2.4Before disclosure
9 Sep 2024Authenticated (Contributor+) Stored Cross-Site Scripting6.4<= 3.2.13.2.2Before disclosure
1 Jul 2024Authenticated(Contributor+) Stored Cross-Site Scripting via Multiple Blocks6.4<= 3.1.93.2.0Before disclosure
1 Jul 2024Authenticated (Contributor+) Stored Cross-Site Scripting via title tag attribute6.4<= 3.1.93.2.0Before disclosure
20 Jun 2024Authenticated (Contributor+) Stored Cross-Site Scripting6.4<= 3.1.73.1.9Before disclosure
18 Jun 2024Authenticated(Contributor+) Stored Cross-Site Scripting via metabox6.4<= 3.1.03.1.1Before disclosure
23 Apr 2024Authenticated (Contributor+) Stored Cross-Site Scripting via Advanced Heading5.4<= 3.1.63.1.7Same day
18 Jul 2023Reflected Cross-Site Scripting via fs_request_get6.1<= 2.5.12.5.2Before disclosure
4 Mar 2022Missing Authorization Checks6.3< 2.4.132.4.13Before disclosure

Sources: Wordfence Intelligence, CISA Known Exploited Vulnerabilities, readme changelogs.

Reputation

Last 90 days: no reviews. Lifetime: 4.9.

Last 90 days vs lifetime average rating for Ultimate Blocks
Last 90 daysNo reviews
Lifetime4.9
Average rating per quarter
Average rating per quarter for Ultimate Blocks
Q3 20255.0
Q4 20255.0
Q1 20265.0
Q2 20265.0
Q3 20265.0

Average rating stayed at 5.0 between Q3 2025 and Q3 2026.

Rating distribution
5 star692
4 star21
3 star7
2 star3
1 star6

Momentum

Active installs
50,000+
Downloads, last full week
2,124
Weekly downloads, last 26 complete weeks
Weekly downloads for Ultimate Blocks
4 May 20261,838
11 May 20263,409
18 May 202623,829
25 May 20264,808
1 Jun 20262,953
8 Jun 20262,218
15 Jun 20262,029
22 Jun 20261,715
29 Jun 202621,938
6 Jul 20265,569
13 Jul 20262,820
20 Jul 20262,530
27 Jul 202622,918
3 Aug 20265,319
10 Aug 20262,474
17 Aug 202624,508
24 Aug 20263,929
31 Aug 202623,253
7 Sep 20263,742
14 Sep 20263,742
21 Sep 202624,504
28 Sep 20263,953
5 Oct 20263,055
12 Oct 20262,308
19 Oct 20262,812
26 Oct 20262,124

Weekly downloads over the last 4 weeks are 67% below the 26-week average.

Healthier alternatives

Same job, rated Healthy, higher Canary Score. Never sponsored.

ExtendifyScore 95 · 500,000+VK BlocksScore 95 · 100,000+VK Block PatternsScore 95 · 100,000+

Facts

Full name
Ultimate Blocks - 25+ Gutenberg Blocks for Block Editor
Version
3.6.1
Author
Ultimate Blocks
Added
28 Feb 2018
Last updated
23 Sep 2026
Active installs
50,000+
Requires WordPress
5.8
Tested up to
7.1.4
Requires PHP
7.2
Category
Content Management > Blog & Article Publishing
Tags
Free, blocks, gutenberg, block-editor, gutenberg blocks

Questions about Ultimate Blocks

Is Ultimate Blocks still maintained?

Yes. Last release 23 Sep 2026, 40 releases in the last 24 months.

Who owns Ultimate Blocks, and has it changed hands?

No change recorded. Main committer imtiazrayhan since Feb 2018.

Was Ultimate Blocks removed from wordpress.org?

No. Listed on wordpress.org as of 4 Nov 2026.

Is Ultimate Blocks safe?

16 known vulnerabilities, all fixed (latest in 3.3.7). Not on the exploited list.

Is the latest Ultimate Blocks update safe to install?

No ownership change before 3.6.1. No one-star spike after it.

Data: wordpress.org Plugins API, plugins SVN and Trac, wordpress.org reviews and support forum, Wordfence Intelligence, CISA KEV, NVD.Plugin data refreshed 4 Nov 2026.Report a data issue