shouldiuse.io

Categories

VERDICT

Blocksy Review

Worth it

Should I use Blocksy?

The best free WordPress theme, optimized for Gutenberg and WooCommerce. Super fast, SEO friendly, easy to use and infinitely customizable. - creativethemes.com

· 1 month ago

Buy if you run WordPress and want a fast, deeply customizable theme — the free tier covers most sites. Avoid if you need enterprise vendor assurances, drag-and-drop builders, or you never update plugins.

Confidence

Medium. Based on 50+ public sources: theme reviews, Reddit threads, security advisories (Wordfence, Patchstack, WPScan), and official docs. No named corporate customers found in evidence; quoted snippets were truncated, so no verbatim user quotes.

Ratings

  • Value for money
  • Ease of use
  • Feature depth
  • Support qualityNo solid evidence either way
  • Security posture

Pricing

$0

Free

ModelNot disclosed
Monthly feesNot disclosed
HardwareNot disclosed
Free tierYes
Pro — PersonalYearly subscription
Pro — Professional & AgencyYearly; lifetime offered

Best for

  • Bloggers and content sites
  • Small WooCommerce stores
  • Freelancers building client sites
  • Gutenberg-first site builders

Not for

  • Non-WordPress projects — a theme only works inside WP
  • Teams needing vendor SLAs, compliance audits, or enterprise support
  • Elementor/Divi loyalists who want drag-and-drop everything
  • Set-and-forget owners who never update plugins or themes

Gotchas - check before you buy

high

Companion Pro had a critical auth bypass (CVE-2026-58480) — update immediately on install

high

Contributor-level RCE (CVE-2026-8365) makes fast patching mandatory on multi-author sites

medium

Stored XSS fixed in 2.0.50 (CVE-2026-2583); older versions stay vulnerable

medium

Three Pro plans plus lifetime Agency option; pricing terms have changed before — verify before committing

Pros and cons

Pros

  • Fast and lean by design; free version listed on
  • Highly customizable; repeatedly praised in r/WordPress comparisons
  • Strong WooCommerce extras like free-shipping progress bars
  • Prebuilt starter sites for quick launches
  • Maintainers ship patches for reported vulnerabilities

Cons

  • Repeated critical CVEs in companion plugin: RCE and login bypass
  • Best features locked behind Pro plans
  • Unfunded indie shop — long-term bus-factor risk
  • Lifetime/Agency pricing has shifted historically; buyers compare notes on Reddit
  • Block-theme workflow frustrates long-time Elementor/Divi page-builder users

Sources & method

- 10 sources - Recurring CVEs 2024–2026, mostly in the Blocksy Companion plugin; maintainers patch quickly, but updating promptly is on you.

official x3review x3security x3news x1
  • CVE-2026-58480 — Auth bypass in Blocksy Companion Pro, Critical: attackers can skip login entirely on affected companion plugin versions.
  • CVE-2026-8365 / GHSA-vj4f-3p4c-m596 — Contributor RCE, PHP object injection lets contributor-level users achieve remote code execution.
  • CVE-2026-2583 — Stored XSS, Authenticated contributor+ stored cross-site scripting; fixed in Blocksy 2.0.50.
  • CSRF in Blocksy theme 1.9.5, Cross-site request forgery vulnerability in older theme versions.

Key stats

  • Value for money: 4/5

    Rating

  • $0

    Starting price

  • 10

    Sources

  • Analyzed

  • Value for money: 4/5. Generous free core; three paid tiers for extras
  • Ease of use: 4/5. Starter sites and live customizer; option overload possible
  • Feature depth: 4/5. Deep for a theme: Woo extras, content blocks, CPTs
  • Support quality. No solid evidence either way
  • Security posture: 2/5. Recurring CVEs, incl. critical companion-plugin flaws
  • Yes Free tier Full theme on WordPress.org
  • $0 Starting price Pro sold in 3 paid plans
  • Unfunded Funding Indie shop per Tracxn
  • 8+ Security advisories CVEs/CSRF/XSS tracked 2024–2026

Pricing

Free

$0

  • Full theme on WordPress.org
  • Gutenberg + WooCommerce ready
  • Starter sites included

Pro — Personal

Yearly subscription

  • Unlocks Pro modules
  • Official support

Pro — Professional & Agency

Yearly; lifetime offered

  • All Pro features
  • Agency/client usage
  • Lifetime price has changed historically

Security

Recurring CVEs 2024–2026, mostly in the Blocksy Companion plugin; maintainers patch quickly, but updating promptly is on you.

  • CVE-2026-58480 — Auth bypass in Blocksy Companion ProCritical: attackers can skip login entirely on affected companion plugin versions.⁹
  • CVE-2026-8365 / GHSA-vj4f-3p4c-m596 — Contributor RCEPHP object injection lets contributor-level users achieve remote code execution.
  • CVE-2026-2583 — Stored XSSAuthenticated contributor+ stored cross-site scripting; fixed in Blocksy 2.0.50.⁷
  • CSRF in Blocksy theme 1.9.5Cross-site request forgery vulnerability in older theme versions.

What users say

r/WordPress consistently ranks Blocksy alongside Kadence and GeneratePress as a fast, heavily customizable Gutenberg theme.

Alternatives

Compare Blocksy with each alternative.

Full analysis

Based on 50+ public sources: theme reviews, Reddit threads, security advisories (Wordfence, Patchstack, WPScan), and official docs. No named corporate customers found in evidence; quoted snippets were truncated, so no verbatim user quotes.

Genuinely fast, free WordPress theme for blogs and Woo stores — but patch the companion plugin; it collects CVEs.

Methodology

Based on 50+ public sources: theme reviews, Reddit threads, security advisories (Wordfence, Patchstack, WPScan), and official docs. No named corporate customers found in evidence; quoted snippets were truncated, so no verbatim user quotes.

Read how a report is made.

Sources

  1. Pricing — Buy Blocksy Procreativethemes.com
    official
  2. Blocksy | WordPress Themewordpress.org
    official
  3. Starter Sitescreativethemes.com
    official
  4. Blocksy Theme Review (2024)wpkube.com
    review
  5. Blocksy Review — WP Mayorwpmayor.com
    review
  6. Advice on Kadence, Blocksy, GeneratePressreddit.com
    review
  7. Blocksy <= 2.0.50 Stored XSS — Wordfencewordfence.com
    security
  8. Contributor RCE in Blocksy — GHSAgithub.com
    security
  9. CVE-2026-58480 login bypasssecuritypointbreak.com
    security
  10. Blocksy company profile — Tracxntracxn.com
    news

Add this review to your site

Blocksy earned a Worth it check.

Put the badge on your site, pricing page, or docs.

Visitors see an independent review.

The link points here, and search engines follow it.

This is the badge visitors see on your site.

Worth it Blocksy Independent review on Should I Use It

Paste one snippet. Keep the link as it is. A nofollow tag stops search engines from following it.

Rate this review

Anonymous. You can change your vote.

Loading votes…

Comments

One queue. No nested comments. Give a display name first. Limit: 200 words per comment and 7 comments per day. You can edit or delete yours.

Save a name to write a comment.

0 / 200 words

No comments yet.