Gutenberg block editor security

When to use this skill

Use this skill whenever code interacts with the block editor beyond simple static blocks:

• Building dynamic blocks with a PHP render_callback.
• Using ServerSideRender to fetch server-rendered markup in the editor.
• Exposing or saving block data via register_rest_field().
• Handling RichText content or allowing markup in block attributes.
• Enqueuing block-editor assets that call custom REST endpoints.

The block editor trusts server-rendered HTML and REST field values. If the server returns unescaped data or allows unauthorized writes, the vulnerability lands inside the editor UI and the saved post content.

Related: see the shortcode-block-security skill for attribute sanitization basics and the rest-api-security skill for REST endpoints.