Block Referer Spam
Block Referer Spam has one disclosed vulnerability in the WordSec catalog, all reported in 2023; it is fixed as of September 2026. Their average CVSS score is 3.3, and the most serious one scores 3.3 out of 10.
The most common weakness is Cross-Site Scripting, behind 1 of the records (100%).
The one issue recorded for Block Referer Spam has a vendor fix available, so running the current release closes it.
All of these findings were reported by Taihei Shimamine. Block Referer Spam is installed on roughly 500 WordPress sites, so each unpatched flaw has a wide blast radius. The current release is tested up to WordPress 7.0.4.
CVE-2023-32497Block Referer Spam <= 1.1.9.4 - Authenticated (Administrator+) Stored Cross-Site Scripting
Read the full analysisVulnerability Records

Block Referer Spam
Author
supersoju
Block Referer Spam stops the bots that fake an HTTP_REFERER header to advertise their own site in your traffic logs and analytics. They’re good enough at simulating real visits that they show up in Google Analytics right alongside genuine traffic — this plugin blocks the known offenders before they’re ever logged, and needs no configuration to start working. Two blocking modes cover different hosting setups: Rewrite mode (Apache only) — adds RewriteCond rules to .htaccess so spam requests are rejected by the web server itself, before WordPress even loads. Fastest option, and the default when your host is detected as Apache. WordPress mode — checks the referer during normal WordPress request handling and returns a 403. Works on any host, including nginx, but can’t intercept a request that’s served entirely from a full-page cache (see the FAQ below) — the plugin will warn you on its settings page if it detects an active caching plugin while running in this mode. The block list itself is a mix of several public spam-referer sources, merged and refreshed automatically once a day (or on demand from the settings page). You can also add your own domains to block, including internationalized (non-ASCII) domain names — they’re normalized automatically. From Wikipedia: Referrer spam (also known as log spam or referrer bombing) is a kind of spamdexing (spamming aimed at search engines). The technique involves making repeated web site requests using a fake referer URL to the site the spammer wishes to advertise. Sites that publish their access logs, including referer statistics, will then inadvertently link back to the spammer's site. These links will be indexed by search engines as they crawl the access logs. This benefits the spammer because the free link improves the spammer site's search engine ranking owing to link-counting algorithms that search engines use. Features Automatic daily updates of the referer spam block list, or trigger an update manually Add your own custom domains to the block list, with automatic IDN/Punycode normalization Two blocking modes to fit Apache or non-Apache hosting: mod_rewrite or WordPress-level Warns you if a caching plugin is likely to interfere with WordPress-mode blocking Pro Pro plans start at $2/mo. Visit BlockReferSpam.com for more information. Sync your custom block list across all of your registered sites Access to additional curated block lists Examples Blocked semalt buttons-for-website floating-share-buttons 4webmaster ilovevitaly … and many more! Found a bug, or want to contribute? Get in touch — support / supersoju.com Cover photo by Lukas Budimaier
Vulnerability data © Defiant, Inc., provided under the Wordfence Intelligence T&C