Protected vulnerabilities.

An unauthenticated checkout field stores JavaScript that executes in admin browsers; BitFire FREE's WAF blocks the malicious POST before WordPress stores it.

Affected sites

2,000

Attack class

Stored Cross-site Scripting

BitFire FREE Bot Protection and WAF stop the unauthenticated AJAX request behind CVE-2026-95864 before it stores script on your site.

Affected sites

5,000+

Attack class

Stored Cross-site Scripting

BitFire's WAF blocks the wpForo CVE-2026-93747 stored XSS payload at the request layer, before it is stored or ever rendered to an admin.

Affected sites

20,000+

Attack class

Stored Cross-site Scripting

BitFire's FREE WAF blocks CVE-2026-93656's payload-bearing request before Profile Builder can persist it or an administrator's browser can run it.

Affected sites

40,000+

Attack class

Cross-site Scripting

BitFire's WAF detects and blocks the unauthenticated stored DOM-based XSS payload in HT Contact Form ≤ 2.10.1 before WordPress processes the request.

Affected sites

10,000+

Attack class

Stored Dom-based Cross-site Scripting

BitFire FREE blocks the double-encoded traversal before vulnerable WordPress template resolution can include an attacker-selected PHP file.

Affected sites

+100,000,000

Attack class

Path Traversal And Local File Inclusion