--- title: "Essential Blocks" description: "Essential Blocks free or Pro: strengths, limitations, pricing, recommended settings (Google Fonts, blocks, AI, file uploads) and patched vulnerabilities." language: "en" locale: "en-US" type: "plugin-sheet" canonical: "https://www.wp-masquerade.com/features/camouflaged-plugins/essential-blocks/" published: "2026-11-05T08:00:00+00:00" modified: "2026-11-05T21:06:46+00:00" translations: en-US: "https://www.wp-masquerade.com/features/camouflaged-plugins/essential-blocks/index.md" fr-FR: "https://www.wp-masquerade.com/fr/fonctionnalites/extensions-camouflees/essential-blocks/index.md" es-ES: "https://www.wp-masquerade.com/es/funcionalidades/plugins-camuflados/essential-blocks/index.md" de-DE: "https://www.wp-masquerade.com/de/funktionen/getarnte-plugins/essential-blocks/index.md" it-IT: "https://www.wp-masquerade.com/it/funzionalita/plugin-camuffati/essential-blocks/index.md" pt-BR: "https://www.wp-masquerade.com/pt/recursos/plugins-wordpress-camuflados/essential-blocks/index.md" nl-NL: "https://www.wp-masquerade.com/nl/functies/gecamoufleerde-plugins/essential-blocks/index.md" --- # Essential Blocks Essential Blocks adds more than 70 blocks to the WordPress editor, including WooCommerce blocks, a form and AI tools. Our take to help you choose between free and Pro, the font, block and security settings to pick, and the vulnerabilities worth knowing. ## The essentials - Best for adding plenty of free blocks to the block editor, WooCommerce blocks included. - Main caveat: your pages depend on essential-blocks/* blocks, and published vulnerabilities are frequent. - Free; Pro costs $49 per year for one site and adds conditional display and advanced forms. ## What Essential Blocks does on your site Essential Blocks adds a library of more than 70 blocks to the WordPress block editor: layout (Row, Flex Container, Wrapper), content (advanced heading, accordion, tabs, info box, table of contents, number counter, timeline), media (filterable gallery, slider, advanced video, Lottie animation, Google Maps), marketing (pricing table, call to action, popup, form) and a set of WooCommerce blocks (product grid, price, rating, images, add to cart button). Every block has per-device settings, and the tablet and mobile breakpoints can be set for the whole site. Around the blocks, the plugin ships editing tools: copy and paste a block’s style onto another, block defaults, global colors and typography, custom CSS, image masking and a “Liquid Glass” effect. The styles and scripts generated for each page are stored in the `uploads/eb-style` folder. An AI module writes text and generates images once you add your own OpenAI API key. The Templates tab lists templates from Templately, the same vendor’s template service. The vendor is WPDeveloper, which also makes Essential Addons for Elementor, Templately and EmbedPress. Essential Blocks Pro is a separate plugin: it adds, among other things, the Data Table, Mega Menu, Query Loop Builder, Advanced Search, Offcanvas and Woo Product Carousel blocks, conditional display, dynamic tags with ACF, password-protected content, GSAP animations and advanced forms. ![Diagram: Essential Blocks works on visitors and bots, wordpress, database and files. Public traces: folder name (hidden with Pro); tag IDs (hidden with Pro); generated-file folders (hidden with Pro); JavaScript variables (still visible); CSS classes (still visible).](https://www.wp-masquerade.com/media/wpm-sheets/essential-blocks/diagram-en.svg?v=a3dc16f1) ## Which sites Essential Blocks is a good fit for Essential Blocks makes sense when you want to stay in the native editor and still have plenty of ready-made blocks: - **Business sites and landing pages**: pricing tables, testimonials, counters, calls to action and popups cover a sales page without a separate page builder. - **Small WooCommerce stores**: the free product blocks let you lay out product pages and grids in the block editor. - **Teams already using WPDeveloper tools**: the Templately templates are built with Essential Blocks, and the vendor’s Agency Bundle groups its plugins together. It’s the wrong pick if you work in Elementor or another page builder: the plugin’s FAQ says it only works with the block editor. It’s also overkill if three or four blocks are all you need. Our [WordPress page builder comparison](https://www.wp-masquerade.com/best-wordpress-page-builders-compared/) helps you pick a layout tool, and [Kadence Blocks](https://www.wp-masquerade.com/features/camouflaged-plugins/kadence-blocks/) and [Spectra](https://www.wp-masquerade.com/features/camouflaged-plugins/spectra/) are its direct alternatives. ## Essential Blocks strengths and limitations ### Strengths - **Lots of free blocks.** More than 70 blocks, including the WooCommerce blocks, the form and the table of contents, at no cost. - **Block-by-block control.** The Blocks tab turns off blocks you don’t need, and they are then no longer loaded on the site. - **Tools for visual consistency.** Block defaults, global colors and typography, and copy-paste of a block’s style. - **Documented external services.** The readme lists every service the plugin calls and what it sends; usage tracking only runs if you opt in. ### Limitations - **Content tied to the plugin.** `essential-blocks/*` blocks lose their rendering if you deactivate the plugin or the block in question. - **Many published vulnerabilities.** About thirty patched flaws according to Patchstack, mostly stored XSS exploitable with a contributor account. - **A limited free form.** Multi-step forms, conditional logic, reCAPTCHA, Mailchimp and storing submissions all require Pro. - **AI that depends on OpenAI.** Text and image generation need your own OpenAI API key, and your prompts go to OpenAI. ## The Essential Blocks settings we recommend These settings exist in the current free version, under the Essential Blocks menu in the admin. | Setting | Recommended value | Why | | --- | --- | --- | | **Automatic updates** Plugins > Essential Blocks | On | The changelog lists security fixes several times a year. | | **Unfiltered File Uploads** Essential Blocks > Settings > Advanced | Off (the default), unless you really need SVG or JSON files | The plugin itself warns that uploading these files can pose security risks. | | **Google Fonts** Essential Blocks > Settings > Optimization Options | Off if your fonts come from the theme | A Google font loaded from Google sends the visitor’s IP address to Google. | | **Unused blocks** Essential Blocks > Blocks | Off, one by one | Less code loaded; first make sure no page uses the block, since its content would stop displaying. | | **FAQ Schema** Essential Blocks > Extensions | Off if your SEO plugin already outputs this data | Avoids two FAQPage markups on the same page. | | **Enable Write with AI and Generate AI Images** Essential Blocks > AI Suite > Features | Off if you don’t use AI | Fewer features exposed to author accounts; the 2026 SSRF flaw went through saving generated images. | | **Regenerate Assets** Essential Blocks > Settings > Optimization Options | Run it if styles are missing after an update | Clears the files generated in `uploads/eb-style`, which are then rebuilt. | - After turning off Google Fonts, view a page’s source: no `fonts.googleapis.com` URL should come from Essential Blocks. - Before turning off a block, search your pages for it, then open them in a private window once it’s off. - Send a test message from every form and check that it arrives. - Under Users, check who has the Contributor or Author role: that’s the account level most of the plugin’s flaws require. ## Essential Blocks security: unauthenticated flaws and recurring XSS Most Essential Blocks vulnerabilities are stored XSS: a contributor account plants a script in a block attribute that isn’t properly escaped. Several more serious flaws, however, required no account at all. The cases worth knowing: - **CVE-2023-4386 and CVE-2023-4402, versions up to 4.2.0**: an unauthenticated [PHP object injection](https://www.wp-masquerade.com/glossary/insecure-deserialization/) through the post and product query functions, fixed in 4.2.1 (CVSS 8.1). - **CVE-2023-6623, versions before 4.4.3**: a local file inclusion possible without an account, when templates were rendered over the REST API. - **CVE-2026-10586, versions up to 6.1.3**: a [server-side request forgery](https://www.wp-masquerade.com/glossary/ssrf/) (SSRF) through saving AI-generated images, with an author account, fixed in 6.1.4 (CVSS 7.2). - **CVE-2026-13153 and CVE-2026-13154, versions before 6.4.0**: two public REST routes let anyone read, without an account, the units sold of each WooCommerce product and entries of non-public post types. - **CVE-2026-96256, versions up to 6.4.5**: a stored XSS through the marker attribute of the Google Maps block, with a contributor account, fixed in 6.4.6 (CVSS 6.4). So turn on automatic updates for the plugin (see our guide to automatic plugin updates) and only give the Contributor and Author roles to people you trust. The two 2026 leaks are also a reminder of what [the WordPress REST API leaves public](https://www.wp-masquerade.com/wordpress-rest-api-security/). WP Masquerade Pro renames the `essential-blocks` and `essential-blocks-pro` folders in file URLs, the tag IDs of its stylesheets and scripts, and the `uploads/eb-style` folder, while the `EssentialBlocksLocalize` JavaScript variable and the `eb-*` and `wp-block-essential-blocks-*` classes stay visible: that makes the plugin harder for bots to spot, but it doesn’t replace updating. ## Essential Blocks FAQ **Does Essential Blocks work with Elementor?** No. The plugin’s FAQ says it only works with the block editor. For Elementor, the same vendor makes a different plugin, Essential Addons for Elementor. **What happens to my pages if I deactivate Essential Blocks?** The `essential-blocks/*` blocks stay in your content, but they no longer display as intended. The plugin’s dashboard gives the same warning: a disabled block stops displaying its content on the pages that use it. **How much does Essential Blocks Pro cost?** The vendor’s pricing page lists $49 per year for one site, $149 per year for 5 sites and $349 per year for 100 sites, or a one-time $399 for 100 sites with lifetime access. The vendor offers a 14-day money-back guarantee. **Are the AI features free?** They’re part of the free version, but only work with your own OpenAI API key. Your prompt, the selected text or image and the key are then sent to OpenAI with every action. ## Key facts - Category: Builders and themes - Vendor: WPDeveloper - Price: Free; Pro from $49 per year for one site - Active installations (wordpress.org): 100 000+ - Version: 6.5.3 - Official page: https://wordpress.org/plugins/essential-blocks/ ## What WP Masquerade hides - Handled by WP Masquerade Pro only - With Pro: folder name, tag IDs, generated-file folders - Still visible: JavaScript variables, CSS classes