Protected vulnerabilities.

BitFire's WAF blocks the script-injection payloads behind CVE-2026-84280, a stored XSS flaw in Fancy Product Designer exploitable by unauthenticated attackers.

Affected sites

Not publicly reported

Attack class

Stored Cross-site Scripting

BitFire's FREE WAF and Bot Protection stop the unauthenticated Contact Form 7 POST that plants stored XSS in Zero Spam's admin Detection Log.

Affected sites

20,000+

Attack class

Stored Cross-site Scripting

An unauthenticated checkout field stores JavaScript that executes in admin browsers; BitFire FREE's WAF blocks the malicious POST before WordPress stores it.

Affected sites

2,000

Attack class

Stored Cross-site Scripting

BitFire FREE Bot Protection and WAF stop the unauthenticated AJAX request behind CVE-2026-95864 before it stores script on your site.

Affected sites

5,000+

Attack class

Stored Cross-site Scripting

BitFire's WAF blocks the wpForo CVE-2026-93747 stored XSS payload at the request layer, before it is stored or ever rendered to an admin.

Affected sites

20,000+

Attack class

Stored Cross-site Scripting

BitFire's FREE WAF blocks CVE-2026-93656's payload-bearing request before Profile Builder can persist it or an administrator's browser can run it.

Affected sites

40,000+

Attack class

Cross-site Scripting