Blackhole Bad Bots Vulnerabilities

Unauthenticated Stored Cross-Site Scripting via User-Agent HTTP Header vulnerability

CVSS:

7.1

Affected:

up to 3.8

Fixed in:

3.8.1

Disclosed:

Mar 30, 2026

The Blackhole for Bad Bots plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the User-Agent HTTP header in all versions up to and including 3.8. This is due to insufficient input sanitization and output escaping. The plugin uses sanitize_text_field() when capturing bot data (which strips HTML tags b...

CVSS:

7.2

Affected:

up to 3.8

Fixed in:

3.8.1

Disclosed:

Mar 25, 2026

CVE-2026-4329 on NVD →

The Blackhole for Bad Bots WordPress plugin before 3.3.2 uses headers such as CF-CONNECTING-IP, CLIENT-IP etc to determine the IP address of requests hitting the blackhole URL, which allows them to be spoofed. This could result in blocking arbitrary IP addresses, such as legitimate/good search engine crawlers / bots. T...

CVSS:

9.1

Affected:

up to 3.3.2

Fixed in:

3.3.2

Disclosed:

Jan 31, 2022

CVE-2022-1165 on NVD →