Protected vulnerabilities.

BitFire's FREE WAF blocks the malicious request URIs behind CVE-2026-65437 before WordPress runs, keeping CleanTalk SpamFireWall die-page XSS from firing.

Affected sites

200000

Attack class

Stored Cross-site Scripting

BitFire FREE Bot Protection stops the scripted submission that delivers CVE-2026-96326 and the WAF strips its XSS payload before WordPress runs.

Affected sites

10000

Attack class

Stored Cross-site Scripting

BitFire Bot Protection blocks the automated AJAX delivery CVE-2026-87741 depends on, stopping ConvertPlus PHP object injection before vulnerable code runs.

Affected sites

Not publicly reported

Attack class

Deserialization Of Untrusted Data

BitFire's WAF inspects request URLs and blocks the Cross-Site Scripting payloads CVE-2026-15273 lets attackers store in Automatic.css 4.0.0.

Affected sites

Not publicly reported

Attack class

Stored Cross-site Scripting

BitFire PRO RASP blocks CVE-2024-10781, an empty-key authentication bypass that lets unauthenticated attackers install and activate arbitrary WordPress plugins.

Affected sites

200000

Attack class

Authentication Bypass

BitFire's FREE WAF blocks the CVE-2022-3302 SQL injection in the CleanTalk Anti-Spam plugin before vulnerable code runs.

Affected sites

200000

Attack class

Sql Injection