Protected vulnerabilities.

BitFire FREE Bot Protection stops the scripted submission that delivers CVE-2026-96326 and the WAF strips its XSS payload before WordPress runs.

Affected sites

10000

Attack class

Stored Cross-site Scripting

BitFire Bot Protection blocks the automated AJAX delivery CVE-2026-87741 depends on, stopping ConvertPlus PHP object injection before vulnerable code runs.

Affected sites

Not publicly reported

Attack class

Deserialization Of Untrusted Data

BitFire's WAF inspects request URLs and blocks the Cross-Site Scripting payloads CVE-2026-15273 lets attackers store in Automatic.css 4.0.0.

Affected sites

Not publicly reported

Attack class

Stored Cross-site Scripting

BitFire FREE Bot Protection and WAF stop CVE-2026-96039, an unauthenticated stored XSS chain in BA Book Everything, before the payload ever reaches WordPress.

Affected sites

10000

Attack class

Stored Cross-site Scripting

BitFire FREE Bot Protection and BitFire PRO RASP stop the unauthenticated CVE-2026-92799 Bookly verification bypass that overwrites customer records.

Affected sites

60000

Attack class

Type Juggling Authorization Bypass

BitFire FREE Bot Protection stops the automated REST delivery of CVE-2026-92713, the Modula Image Gallery Author-level arbitrary file deletion flaw.

Affected sites

100000

Attack class

Missing Authorization