Block Referer Spam

Block Referer Spam has one disclosed vulnerability in the WordSec catalog, all reported in 2023; it is fixed as of September 2026. Their average CVSS score is 3.3, and the most serious one scores 3.3 out of 10.

The most common weakness is Cross-Site Scripting, behind 1 of the records (100%).

The one issue recorded for Block Referer Spam has a vendor fix available, so running the current release closes it.

All of these findings were reported by Taihei Shimamine. Block Referer Spam is installed on roughly 500 WordPress sites, so each unpatched flaw has a wide blast radius. The current release is tested up to WordPress 7.0.4.

Strategic Overview

Avg CVSSLow
3.3/ 10
Patch Coverage100%
Open

0

Fixed

1

Get automatic notifications for all Block Referer Spam vulnerabilities before they are exploited.

Highest severity on recordCVSS 3.3CVE-2023-32497

Block Referer Spam <= 1.1.9.4 - Authenticated (Administrator+) Stored Cross-Site Scripting

Read the full analysis

Vulnerability Records

1 records
Block Referer Spam banner
Latestv1.2

Block Referer Spam

supersoju

Author

supersoju

3.4(21)
68/100
Last Updated
2026-08-16 (27d ago)
Active Installs
500+
Downloads
25,926
Requires WP
3.0.2+
Requires PHP
0+
Tested up to
WP 7.0.4
Created
2015-07-16 (11y ago)

Block Referer Spam stops the bots that fake an HTTP_REFERER header to advertise their own site in your traffic logs and analytics. They’re good enough at simulating real visits that they show up in Google Analytics right alongside genuine traffic — this plugin blocks the known offenders before they’re ever logged, and needs no configuration to start working. Two blocking modes cover different hosting setups: Rewrite mode (Apache only) — adds RewriteCond rules to .htaccess so spam requests are rejected by the web server itself, before WordPress even loads. Fastest option, and the default when your host is detected as Apache. WordPress mode — checks the referer during normal WordPress request handling and returns a 403. Works on any host, including nginx, but can’t intercept a request that’s served entirely from a full-page cache (see the FAQ below) — the plugin will warn you on its settings page if it detects an active caching plugin while running in this mode. The block list itself is a mix of several public spam-referer sources, merged and refreshed automatically once a day (or on demand from the settings page). You can also add your own domains to block, including internationalized (non-ASCII) domain names — they’re normalized automatically. From Wikipedia: Referrer spam (also known as log spam or referrer bombing) is a kind of spamdexing (spamming aimed at search engines). The technique involves making repeated web site requests using a fake referer URL to the site the spammer wishes to advertise. Sites that publish their access logs, including referer statistics, will then inadvertently link back to the spammer's site. These links will be indexed by search engines as they crawl the access logs. This benefits the spammer because the free link improves the spammer site's search engine ranking owing to link-counting algorithms that search engines use. Features Automatic daily updates of the referer spam block list, or trigger an update manually Add your own custom domains to the block list, with automatic IDN/Punycode normalization Two blocking modes to fit Apache or non-Apache hosting: mod_rewrite or WordPress-level Warns you if a caching plugin is likely to interfere with WordPress-mode blocking Pro Pro plans start at $2/mo. Visit BlockReferSpam.com for more information. Sync your custom block list across all of your registered sites Access to additional curated block lists Examples Blocked semalt buttons-for-website floating-share-buttons 4webmaster ilovevitaly … and many more! Found a bug, or want to contribute? Get in touch — support / supersoju.com Cover photo by Lukas Budimaier

Vulnerability data © Defiant, Inc., provided under the Wordfence Intelligence T&C