Protected vulnerabilities.

BitFire FREE Bot Protection stops the automated REST delivery of CVE-2026-92713, the Modula Image Gallery Author-level arbitrary file deletion flaw.

Affected sites

100000

Attack class

Missing Authorization

BitFire's FREE WAF blocks the malicious query-string payloads behind the JetFormBuilder CVE-2026-92212 reflected XSS before WordPress processes the request.

Affected sites

80000

Attack class

Reflected Cross-site Scripting

CVE-2026-89426 lets any Knit Pay 9.6.1.0 user become administrator via Gravity Forms. BitFire FREE Bot Protection and PRO RASP stop the chain.

Affected sites

2000

Attack class

Broken Access Control

BitFire's WAF blocks the script-injection payloads behind CVE-2026-84280, a stored XSS flaw in Fancy Product Designer exploitable by unauthenticated attackers.

Affected sites

Not publicly reported

Attack class

Stored Cross-site Scripting

BitFire's WAF inspects request URLs and blocks the unauthenticated stored XSS payload CVE-2026-15273 injects through REQUEST_URI in Automatic.css 4.0.0.

Affected sites

Not publicly reported

Attack class

Stored Cross-site Scripting

BitFire's FREE WAF and Bot Protection stop the unauthenticated Contact Form 7 POST that plants stored XSS in Zero Spam's admin Detection Log.

Affected sites

20,000+

Attack class

Stored Cross-site Scripting