Skip to main content
cve.nowby Sazabi
← All vulnerabilities
CVE-2026-93029

There is a stored XSS vulnerability allowing arbitrary code execution in the WHM Manage SSL Hosts interface.

Published
Last modified
Status
published
Known exploitation
Not listed in CISA KEV
Fix
Fixed in 11.138.0.11, 11.136.0.45, 11.134.0.61, 11.110.0.148, 11.138.1.13
Public exploit
None on Exploit-DB
CISA SSVC
  • Exploitation: none
  • Automatable: no
  • Technical impact: total
?

Decision points from CISA's Vulnrichment, assessed (SSVC 2.0.3).

SSVC documentation

Summary

There is a stored XSS vulnerability allowing arbitrary code execution in the WHM Manage SSL Hosts interface.

Affected versions

  • Webpros cPanel

    fixed in 11.138.0.11; fixed in 11.136.0.45; fixed in 11.134.0.61; fixed in 11.110.0.148

  • Webpros WP Squared

    fixed in 11.138.1.13

References 7

hackerone.com

support.cpanel.net

docs.cpanel.net

docs.wpsquared.com