What is the CVSS score of CVE-2026-4329?

CVE-2026-4329 has a CVSS 3.1 base score of 7.2 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N. EPSS exploitation probability: 0.1%.

Which versions of Blackhole For Bad Bots are affected by CVE-2026-4329?

A stored cross-site scripting vulnerability in the Blackhole for Bad Bots WordPress plugin allows attackers to inject malicious code that executes when administrators view the Bad Bots log,…

How to fix or mitigate CVE-2026-4329?

Within 24 hours: Disable the Blackhole for Bad Bots plugin immediately and assess whether alternative bot protection solutions are in place. Within 7 days: Audit admin accounts for suspicious activity and review access logs for unauthorized changes; evaluate alternative plugins or security solutions for bot mitigation. Within 30 days: Monitor the plugin's GitHub repository and vendor communications for patch availability; develop a process to rapidly deploy updates once released.

Blackhole For Bad Bots CVE-2026-4329

EUVD-2026-16102 HIGH

Cross-site Scripting (XSS) (CWE-79)

2026-03-26 Wordfence

WordPress XSS Blackhole For Bad Bots Wordpress Plugin Specialk

7.2

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

7.2 HIGH

AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Changed

Confidentiality

Low

Integrity

Low

Availability

None

Lifecycle Timeline

Re-analysis Queued

Apr 24, 2026 - 16:37 vuln.today

cvss_changed

EUVD ID Assigned

Mar 26, 2026 - 04:30 euvd

EUVD-2026-16102

Analysis Generated

Mar 26, 2026 - 04:30 vuln.today

CVE Published

Mar 26, 2026 - 03:37 nvd

HIGH 7.2

DescriptionCVE.org

The Blackhole for Bad Bots plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the User-Agent HTTP header in all versions up to and including 3.8. This is due to insufficient input sanitization and output escaping. The plugin uses sanitize_text_field() when capturing bot data (which strips HTML tags but does not escape HTML entities like double quotes), then stores the data via update_option(). When an administrator views the Bad Bots log page, the stored data is output directly into HTML input value attributes (lines 75-83) without esc_attr() and into HTML span content without esc_html(). This makes it possible for unauthenticated attackers to inject arbitrary web scripts that execute when an administrator views the Blackhole Bad Bots admin page.

AnalysisAI

The Blackhole for Bad Bots plugin for WordPress contains a Stored Cross-Site Scripting vulnerability that allows unauthenticated attackers to inject malicious scripts through the User-Agent HTTP header. All versions up to and including 3.8 are affected. The vulnerability stems from insufficient output escaping when displaying bot data in the admin interface, enabling arbitrary JavaScript execution when administrators view the Bad Bots log page.

Technical ContextAI

This vulnerability affects the Blackhole for Bad Bots WordPress plugin (CPE: cpe:2.3:a:specialk:blackhole_for_bad_bots:*:*:*:*:*:*:*:*). The root cause is CWE-79 (Improper Neutralization of Input During Web Page Generation). The plugin uses sanitize_text_field() to process User-Agent data during bot detection, which strips HTML tags but fails to escape HTML entities like double quotes. This sanitized data is stored via update_option() and later rendered in the admin interface (badbots-register.php lines 75-83) directly into HTML input value attributes without esc_attr() and into span elements without esc_html(). The vulnerability represents a two-stage attack: injection during bot logging and execution when administrators view the logs, making it a classic stored XSS scenario where untrusted user input flows through storage to a privileged context without proper output encoding.

RemediationAI

Update the Blackhole for Bad Bots plugin to version 3.8.1 or later, which implements proper output escaping as documented in changeset 3487350 available at https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3487350%40blackhole-bad-bots&new=3487350%40blackhole-bad-bots&sfp_email=&sfph_mail=. The patch adds esc_attr() calls for data rendered in HTML attributes and esc_html() for content rendered in HTML elements. Until patching is possible, administrators should avoid viewing the Bad Bots log page if untrusted bots have been detected, implement Content Security Policy headers to restrict inline script execution in the WordPress admin area, and consider temporarily disabling the plugin if active exploitation is suspected. Organizations should also review WordPress admin session logs for any suspicious activity that may have occurred while viewing the Bad Bots interface and ensure all administrator accounts use strong authentication with two-factor authentication enabled.