shouldiuse.io

VERDICT

Should I use Blocksy?

The best free WordPress theme, optimized for Gutenberg and WooCommerce. Super fast, SEO friendly, easy to use and infinitely customizable. - creativethemes.com

Worth it. Buy if you run WordPress and want a fast, deeply customizable theme — the free tier covers most sites. Avoid if you need enterprise vendor assurances, drag-and-drop builders, or you never update plugins.

Confidence

Medium. Based on 50+ public sources: theme reviews, Reddit threads, security advisories (Wordfence, Patchstack, WPScan), and official docs. No named corporate customers found in evidence; quoted snippets were truncated, so no verbatim user quotes.

Ratings

  • Value for money
  • Ease of use
  • Feature depth
  • Support qualityNo solid evidence either way
  • Security posture

Pricing

$0

Free

ModelNot disclosed
Monthly feesNot disclosed
HardwareNot disclosed
Free tierYes
Pro — PersonalYearly subscription
Pro — Professional & AgencyYearly; lifetime offered

Best for

  • Bloggers and content sites
  • Small WooCommerce stores
  • Freelancers building client sites
  • Gutenberg-first site builders

Not for

  • Non-WordPress projects — a theme only works inside WP
  • Teams needing vendor SLAs, compliance audits, or enterprise support
  • Elementor/Divi loyalists who want drag-and-drop everything
  • Set-and-forget owners who never update plugins or themes

Gotchas - check before you buy

high

Companion Pro had a critical auth bypass (CVE-2026-58480) — update immediately on install

high

Contributor-level RCE (CVE-2026-8365) makes fast patching mandatory on multi-author sites

medium

Stored XSS fixed in 2.0.50 (CVE-2026-2583); older versions stay vulnerable

medium

Three Pro plans plus lifetime Agency option; pricing terms have changed before — verify before committing

Pros and cons

Pros

  • Fast and lean by design; free version listed on
  • Highly customizable; repeatedly praised in r/WordPress comparisons
  • Strong WooCommerce extras like free-shipping progress bars
  • Prebuilt starter sites for quick launches
  • Maintainers ship patches for reported vulnerabilities

Cons

  • Repeated critical CVEs in companion plugin: RCE and login bypass
  • Best features locked behind Pro plans
  • Unfunded indie shop — long-term bus-factor risk
  • Lifetime/Agency pricing has shifted historically; buyers compare notes on Reddit
  • Block-theme workflow frustrates long-time Elementor/Divi page-builder users

Sources & method

Analyzed 9/25/2026 - 10 sources - Recurring CVEs 2024–2026, mostly in the Blocksy Companion plugin; maintainers patch quickly, but updating promptly is on you.

official x3review x3security x3news x1
  • CVE-2026-58480 — Auth bypass in Blocksy Companion Pro, Critical: attackers can skip login entirely on affected companion plugin versions.
  • CVE-2026-8365 / GHSA-vj4f-3p4c-m596 — Contributor RCE, PHP object injection lets contributor-level users achieve remote code execution.
  • CVE-2026-2583 — Stored XSS, Authenticated contributor+ stored cross-site scripting; fixed in Blocksy 2.0.50.
  • CSRF in Blocksy theme 1.9.5, Cross-site request forgery vulnerability in older theme versions.

Key stats

  • Value for money: 4/5

    Rating

  • $0

    Starting price

  • 10

    Sources

  • Analyzed

  • Value for money: 4/5. Generous free core; three paid tiers for extras
  • Ease of use: 4/5. Starter sites and live customizer; option overload possible
  • Feature depth: 4/5. Deep for a theme: Woo extras, content blocks, CPTs
  • Support quality. No solid evidence either way
  • Security posture: 2/5. Recurring CVEs, incl. critical companion-plugin flaws
  • Yes Free tier Full theme on WordPress.org
  • $0 Starting price Pro sold in 3 paid plans
  • Unfunded Funding Indie shop per Tracxn
  • 8+ Security advisories CVEs/CSRF/XSS tracked 2024–2026

Pricing

Free

$0

  • Full theme on WordPress.org
  • Gutenberg + WooCommerce ready
  • Starter sites included

Pro — Personal

Yearly subscription

  • Unlocks Pro modules
  • Official support

Pro — Professional & Agency

Yearly; lifetime offered

  • All Pro features
  • Agency/client usage
  • Lifetime price has changed historically

Security

Recurring CVEs 2024–2026, mostly in the Blocksy Companion plugin; maintainers patch quickly, but updating promptly is on you.

  • CVE-2026-58480 — Auth bypass in Blocksy Companion ProCritical: attackers can skip login entirely on affected companion plugin versions.⁹
  • CVE-2026-8365 / GHSA-vj4f-3p4c-m596 — Contributor RCEPHP object injection lets contributor-level users achieve remote code execution.
  • CVE-2026-2583 — Stored XSSAuthenticated contributor+ stored cross-site scripting; fixed in Blocksy 2.0.50.⁷
  • CSRF in Blocksy theme 1.9.5Cross-site request forgery vulnerability in older theme versions.

What users say

r/WordPress consistently ranks Blocksy alongside Kadence and GeneratePress as a fast, heavily customizable Gutenberg theme.

Alternatives

Compare Blocksy with each alternative.

Full analysis

Based on 50+ public sources: theme reviews, Reddit threads, security advisories (Wordfence, Patchstack, WPScan), and official docs. No named corporate customers found in evidence; quoted snippets were truncated, so no verbatim user quotes.

Genuinely fast, free WordPress theme for blogs and Woo stores — but patch the companion plugin; it collects CVEs.

Methodology

Based on 50+ public sources: theme reviews, Reddit threads, security advisories (Wordfence, Patchstack, WPScan), and official docs. No named corporate customers found in evidence; quoted snippets were truncated, so no verbatim user quotes.

Sources

  1. Pricing — Buy Blocksy Procreativethemes.com
    official
  2. Blocksy | WordPress Themewordpress.org
    official
  3. Starter Sitescreativethemes.com
    official
  4. Blocksy Theme Review (2024)wpkube.com
    review
  5. Blocksy Review — WP Mayorwpmayor.com
    review
  6. Advice on Kadence, Blocksy, GeneratePressreddit.com
    review
  7. Blocksy <= 2.0.50 Stored XSS — Wordfencewordfence.com
    security
  8. Contributor RCE in Blocksy — GHSAgithub.com
    security
  9. CVE-2026-58480 login bypasssecuritypointbreak.com
    security
  10. Blocksy company profile — Tracxntracxn.com
    news

Rate this review

Anonymous. You can change your vote.

Loading votes…

Comments

One queue. No nested comments. Give a display name first. Limit: 200 words per comment and 7 comments per day. You can edit or delete yours.

Save a name to write a comment.

0 / 200 words

No comments yet.