The Blackhole for Bad Bots plugin for WordPress contains a stored cross‑site scripting flaw that allows malicious content to be injected into the User‑Agent HTTP header. When an attacker submits a crafted header, the plugin stores the value without proper escaping. When an administrator later views the Bad Bots log page, the stored value is output directly into HTML input elements and span tags, enabling arbitrary JavaScript execution in the admin browser.

This vulnerability affects all versions of the Blackhole for Bad Bots plugin up to and including 3.8. Servers running WordPress with this plugin installed, regardless of other configurations, are susceptible if the plugin is active.

The CVSS score for this issue is 7.2, indicating a high risk impact. Although EPSS data is not available and the issue is not listed in CISA's KEV catalog, the flaw can be exploited remotely by manipulating the User‑Agent header; an attacker needs only to ensure that an administrator views the log page to trigger the malicious script. The resulting cross‑site scripting can allow an attacker to hijack the administrator session, steal credentials, or perform malicious actions within the WordPress site.