Please report suspected vulnerabilities privately to the project maintainer before publishing technical details. Include the affected version, reproduction steps, impact, and any suggested remediation. Do not include real credentials or private customer data.

Markdown is treated as untrusted content. Raw HTML and code are displayed as text unless generated by the plugin's fixed renderer. Live Markdown output is filtered through a narrow WordPress KSES allowlist.

The plugin does not add public endpoints, AJAX actions, REST routes, upload handlers, database queries, filesystem writes, server-side remote HTTP requests, telemetry, or executable template input.

MarkBlocks relies on WordPress and Elementor's existing permissions, nonces, and authorization checks for editing and saving Elementor documents. It does not create capabilities or bypass Elementor's save controls.

• Install releases from a trusted source.
• Test WordPress and Elementor upgrades on staging.
• Treat remote image URLs as third-party resources that receive normal browser requests.
• Do not place passwords, API tokens, private keys, or other secrets in Markdown or code examples because the source remains stored in the Elementor document.
• Limit Elementor editing access to trusted users.
• Keep WordPress, Elementor, themes, and other plugins updated.

The review covered stored and DOM XSS, unsafe URL schemes, shortcode interpretation, generated-element deletion integrity, parser recursion, LF/CRLF/CR line counting, input-size limits, highlighter complexity, direct-access guards, capability boundaries, internationalization, accessibility of interactive controls, external dependencies, package hygiene, and dangerous PHP/JavaScript constructs.

A code review cannot prove software is vulnerability-free. A live staging test and independent review remain recommended before deployment on a high-risk site.