Protected vulnerabilities.

BitFire's FREE WAF blocks the malicious query-string payloads behind the JetFormBuilder CVE-2026-92212 reflected XSS before WordPress processes the request.

Affected sites

80000

Attack class

Reflected Cross-site Scripting

CVE-2026-89426 lets any Knit Pay 9.6.1.0 user become administrator via Gravity Forms. BitFire FREE Bot Protection and PRO RASP stop the chain.

Affected sites

2000

Attack class

Broken Access Control

BitFire FREE Bot Protection and WAF stop the unauthenticated AJAX delivery and script payload behind CVE-2026-84281 before Fancy Product Designer stores it.

Affected sites

Not publicly reported

Attack class

Stored Cross-site Scripting

BitFire's WAF blocks the script-injection payloads behind CVE-2026-84280, a stored XSS flaw in Fancy Product Designer exploitable by unauthenticated attackers.

Affected sites

Not publicly reported

Attack class

Stored Cross-site Scripting

BitFire's FREE WAF and Bot Protection stop the unauthenticated Contact Form 7 POST that plants stored XSS in Zero Spam's admin Detection Log.

Affected sites

20,000+

Attack class

Stored Cross-site Scripting

An unauthenticated checkout field stores JavaScript that executes in admin browsers; BitFire FREE's WAF blocks the malicious POST before WordPress stores it.

Affected sites

2,000

Attack class

Stored Cross-site Scripting