CVE-2026-4329
Published: 26 March 2026
Summary
CVE-2026-4329 is a high-severity Cross-site Scripting (CWE-79) vulnerability in Wordpress (inferred from references). Its CVSS base score is 7.2 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked at the 47.1th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified are NIST 800-53 SI-10 (Information Input Validation) and SI-15 (Information Output Filtering).
Deeper analysis
CVE-2026-4329 is a stored cross-site scripting (XSS) vulnerability in the Blackhole for Bad Bots plugin for WordPress, affecting all versions up to and including 3.8. The issue arises from insufficient input sanitization and output escaping when handling the User-Agent HTTP header. Specifically, the plugin uses sanitize_text_field() to process bot data, which removes HTML tags but fails to escape HTML entities such as double quotes. This data is then stored via update_option(). On the Bad Bots log admin page, the stored data is output directly into HTML input value attributes (lines 75-83) without esc_attr() and into HTML span content without esc_html(), enabling script injection.
Unauthenticated attackers can exploit this vulnerability over the network with low complexity and no privileges required, as indicated by the CVSS v3.1 base score of 7.2 (AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N) and CWE-79 classification. By sending a crafted HTTP request with a malicious User-Agent header containing script payloads, attackers can store XSS payloads. These payloads execute in the context of an administrator's browser when they view the Blackhole Bad Bots admin page, potentially leading to low confidentiality and integrity impacts with changed scope.
The provided references point to specific lines in the plugin's source code on the WordPress plugin trac repository, including badbots-register.php lines 75, 79, and 85; blackhole-core.php line 180; and blackhole-helpers.php line 22. These highlight the exact locations of improper output handling, underscoring the need for developers to apply proper WordPress escaping functions like esc_attr() and esc_html() in updates. No patch details are specified in the available information.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2026-16102
Vulnerability details
The Blackhole for Bad Bots plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the User-Agent HTTP header in all versions up to and including 3.8. This is due to insufficient input sanitization and output escaping. The plugin uses…
more
sanitize_text_field() when capturing bot data (which strips HTML tags but does not escape HTML entities like double quotes), then stores the data via update_option(). When an administrator views the Bad Bots log page, the stored data is output directly into HTML input value attributes (lines 75-83) without esc_attr() and into HTML span content without esc_html(). This makes it possible for unauthenticated attackers to inject arbitrary web scripts that execute when an administrator views the Blackhole Bad Bots admin page.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Stored XSS in public-facing WordPress plugin directly enables network exploitation of the app (T1190) and attacker-controlled JavaScript execution in admin browser context via unsanitized User-Agent input (T1059.007).
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
Directly mandates comprehensive input validation and sanitization of untrusted data like the User-Agent header to prevent storage of malicious XSS payloads.
Requires filtering and escaping of stored data prior to output in admin pages, directly addressing the lack of esc_attr() and esc_html() to block script execution.
Ensures timely identification, reporting, and patching of the specific flaw in the plugin's sanitization and output handling mechanisms.