CVE-2026-4329 is a stored cross-site scripting vulnerability in the Blackhole for Bad Bots WordPress plugin (up to version 3.8). The plugin captures bot data from the User-Agent HTTP header using sanitize_text_field(), which removes HTML tags but does not escape HTML entities such as double quotes. The data is stored via update_option() and later output into HTML input value attributes and span elements on the admin Bad Bots log page without using esc_attr() or esc_html() for proper escaping. This allows unauthenticated attackers to inject arbitrary JavaScript that executes in the context of the administrator's browser when viewing the log page.

Successful exploitation allows unauthenticated attackers to execute arbitrary scripts in the administrator's browser context. This can lead to session hijacking, unauthorized actions, or other attacks against the administrator. The vulnerability affects confidentiality and integrity but does not impact availability. The CVSS 3.1 base score is 7.2 (high), reflecting network attack vector, low attack complexity, no privileges required, no user interaction, and partial impact on confidentiality and integrity.

No official patch or fix is currently available for this vulnerability. Administrators should avoid viewing the Bad Bots log page until a fix is released. Monitor the vendor's advisory channels for updates. Applying manual mitigations such as disabling the plugin or restricting access to the admin log page may reduce risk. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance.