Bot Block – Stop Spam Referrals in Google Analytics

Bot Block – Stop Spam Referrals in Google Analytics has one disclosed vulnerability in the WordSec catalog, all reported in 2025; it remains unpatched as of September 2026. Their average CVSS score is 4.4, and the most serious one scores 4.4 out of 10.

The most common weakness is Cross-Site Scripting, behind 1 of the records (100%).

The one issue recorded for Bot Block – Stop Spam Referrals in Google Analytics has no published fix yet, which makes virtual patching the only reliable mitigation. The oldest unresolved one dates back to 2025.

All of these findings were reported by Nabil Irawan. Bot Block – Stop Spam Referrals in Google Analytics is installed on roughly 500 WordPress sites, so each unpatched flaw has a wide blast radius. The current release is tested up to WordPress 4.4.34.

Strategic Overview

Avg CVSSMedium
4.4/ 10
Patch Coverage0%
Open

1

Fixed

0

Get automatic notifications for all Bot Block – Stop Spam Referrals in Google Analytics vulnerabilities before they are exploited.

Most severe open issueCVSS 4.4CVE-2025-57935

Bot Block – Stop Spam Referrals in Google Analytics <= 2.6 - Authenticated (Administrator+) Stored Cross-Site Scripting

Read the full analysis

Vulnerability Records

1 records
Bot Block – Stop Spam Referrals in Google Analytics banner
Latestv2.6

Bot Block – Stop Spam Referrals in Google Analytics

Ricky Dawn

Author

Ricky Dawn

4.2(17)
84/100
Last Updated
2016-02-24 (11y ago)
Active Installs
500+
Downloads
19,887
Requires WP
3.9+
Requires PHP
0+
Tested up to
WP 4.4.34
Created
2015-07-27 (11y ago)

This plugin has two main functions: To stop spam traffic before it reaches your site (which stops spam visits showing in Analytics). Save bandwidth, bots use bandwidth when they visit your site, this plugin stops them before they get the chance to download anything. Spam traffic is an increasing problem, companies like semalt are spamming sites in order to get their website shown within Google Analytics as a referrer (also known as referral spam). More spammers are beginning to take this approach and this causes issues for any Analytics user that relies on the data collected since pageviews and visitors are inflated. Spammers have even taken this a step further by triggering events, which of course can effect conversion data. This plugin is built to stop this, it blocks spam bots before your website loads which not only stops the traffic appearing within Google Analytics but it also saves you Bandwidth. The spam bots blocked are pulled from a central database of known bots, this database is updated as new spam bots are found, you also have the option to add your own referrer URL’s to block. Features Include: Central database containing tons of known spam bots Ability to add your own custom referrer domains to block You can either 301 the spam traffic to another site OR show a 403 error message to spammers Full statistics, detailing most blocked bots, total blocks and number of sites in block list Ability to block all subdomains of a domain e.g. spam.semalt.com Video showing you how to block &#8216;ghost referrers’ (the spam that cannot be blocked since they do not visit your site) The ability to contribute to our growing list of spam bots Tags seo, SEO, google, google analytics, google analytics spam, spam, bot block, bot blocker, bot blocking, block bots, semalt, 100dollarsseo, analytics spam blocker

Vulnerability data © Defiant, Inc., provided under the Wordfence Intelligence T&C