CVE-2021-25070: Stopbadbots Block And Stop Bad Bots

Critical severity, CVSS 9.8. EPSS: 1.6% chance of exploitation in the next 30 days.

The Block Bad Bots WordPress plugin before 6.88 does not properly sanitise and escape the User Agent before using it in a SQL statement to record logs, leading to an SQL Injection issue

Affected products

• Stopbadbots Block And Stop Bad Bots: before 6.88 (fixed in 6.88)

Published 2022-03-28. Last modified 2026-06-17.