EUVD-2026-16102Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessSend HTTP request with malicious User-Agent header
-
DeliveryPlugin sanitizes but fails to escape entities
-
ExploitMalicious payload stored in database
-
ExecutionAdministrator views Bad Bots log
-
ImpactStored XSS executes in admin browser
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A05:2025 - Injection
ASVS 5.0
V1 - Encoding and Sanitization Output encoding, context-aware escaping
MITRE ATT&CK
2 techniques across 2 tactics: Initial Access, Execution The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | The Blackhole for Bad Bots WordPress plugin versions up to 3.8 must be installed and activated. An unauthenticated attacker sends a crafted User-Agent HTTP header containing XSS payload. When a WordPress administrator views the Bad Bots log page, the stored malicious payload executes in their browser. |
| Impact | The CVSS score of 7.2 (HIGH) reflects the network attack vector (AV:N), low complexity (AC:L), and no required privileges (PR:N), though it requires administrator interaction (UI:N appears incorrect; UI:R would be more accurate as admin must view the log page). The Changed scope (S:C) indicates the vulnerability can affect resources beyond its original security context. Despite the high CVSS score, real-world risk is moderated by several factors: exploitation requires an administrator to actively view the Bad Bots log page, limiting automatic exploitation potential; the attacker must first trigger the bot detection mechanism by accessing the honeypot URL; and the impact is confined to the administrative context rather than affecting site visitors. The vulnerability is well-documented with multiple source code references provided by Wordfence, and a patch changeset (3487350) is available in the WordPress plugin repository. No EPSS score or KEV listing was provided, suggesting limited evidence of active exploitation in the wild. This represents a legitimate security concern for sites using the plugin, particularly those with multiple administrators or where admin sessions might be hijacked, but it's not an emergency-level threat requiring immediate offline remediation. |
| Exploit ScenarioDerived | An unauthenticated attacker crafts a malicious User-Agent header containing JavaScript payload (such as a double-quote to break out of an HTML attribute followed by an onclick handler or script tag) and sends HTTP requests to the WordPress site, intentionally triggering the Blackhole bot detection mechanism by accessing the honeypot URL. When a WordPress administrator later logs into the admin panel and navigates to the Bad Bots log page to review detected bots, the stored malicious script executes in their browser context, potentially allowing the attacker to steal admin session cookies, create new administrative accounts, modify site content, or install malicious plugins. Given the network-accessible attack vector and low complexity, this could be automated against multiple WordPress sites running the vulnerable plugin. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Mar 26, 2026
The Blackhole for Bad Bots plugin for WordPress contains a Stored Cross-Site Scripting vulnerability that allows unauthenticated attackers to inject malicious scripts through the User-Agent HTTP header. All versions up to and including 3.8 are affected. The vulnerability stems from insufficient output escaping when displaying bot data in the admin interface, enabling arbitrary JavaScript execution when administrators view the Bad Bots log page.
RemediationAI
Update the Blackhole for Bad Bots plugin to version 3.8.1 or later, which implements proper output escaping as documented in changeset 3487350 available at https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3487350%40blackhole-bad-bots&new=3487350%40blackhole-bad-bots&sfp_email=&sfph_mail=. The patch adds esc_attr() calls for data rendered in HTML attributes and esc_html() for content rendered in HTML elements. Until patching is possible, administrators should avoid viewing the Bad Bots log page if untrusted bots have been detected, implement Content Security Policy headers to restrict inline script execution in the WordPress admin area, and consider temporarily disabling the plugin if active exploitation is suspected. Organizations should also review WordPress admin session logs for any suspicious activity that may have occurred while viewing the Bad Bots interface and ensure all administrator accounts use strong authentication with two-factor authentication enabled.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
This vulnerability affects the Blackhole for Bad Bots WordPress plugin (CPE: cpe:2.3:a:specialk:blackhole_for_bad_bots:*:*:*:*:*:*:*:*). The root cause is CWE-79 (Improper Neutralization of Input During Web Page Generation). The plugin uses sanitize_text_field() to process User-Agent data during bot detection, which strips HTML tags but fails to escape HTML entities like double quotes. This sanitized data is stored via update_option() and later rendered in the admin interface (badbots-register.php lines 75-83) directly into HTML input value attributes without esc_attr() and into span elements without esc_html(). The vulnerability represents a two-stage attack: injection during bot logging and execution when administrators view the logs, making it a classic stored XSS scenario where untrusted user input flows through storage to a privileged context without proper output encoding.
Know when Blackhole For Bad Bots gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N
Primary rating from NVD · only source for this CVE.
CVSS VectorNVD
DescriptionCVE.org
The Blackhole for Bad Bots plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the User-Agent HTTP header in all versions up to and including 3.8. This is due to insufficient input sanitization and output escaping. The plugin uses sanitize_text_field() when capturing bot data (which strips HTML tags but does not escape HTML entities like double quotes), then stores the data via update_option(). When an administrator views the Bad Bots log page, the stored data is output directly into HTML input value attributes (lines 75-83) without esc_attr() and into HTML span content without esc_html(). This makes it possible for unauthenticated attackers to inject arbitrary web scripts that execute when an administrator views the Blackhole Bad Bots admin page.
Executive ViewAI
A stored cross-site scripting vulnerability in the Blackhole for Bad Bots WordPress plugin allows attackers to inject malicious code that executes when administrators view the Bad Bots log, potentially compromising admin accounts and enabling lateral movement into your WordPress environment. This affects all organizations running this plugin on versions 3.8 and earlier, with no patch currently available.
Disable the Blackhole for Bad Bots plugin entirely until a patch is released; restrict WordPress admin panel access via IP allowlisting or WAF rules to known administrative networks; implement Web Application Firewall (WAF) rules to block suspicious User-Agent headers and monitor for injection attempts; enforce multi-factor authentication for all admin accounts to reduce compromise impact; consider alternative bot protection solutions (e.g., Cloudflare, Akamai, or native WordPress security plugins with active maintenance).
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Cross-Site Scripting occurs when an application accepts untrusted data and sends it to a web browser without proper validation or encoding.
GitHub PoC
Exploit-DB