Skip to main content
cve.nowby Sazabi
← All vulnerabilities
CVE-2026-93697

There is a stored XSS vulnerability allowing arbitrary code execution in the WHM Mass Modify Accounts interface.

Published
Last modified
Status
published
Known exploitation
Not listed in CISA KEV
Fix
Fixed in 11.138.0.11, 11.136.0.45, 11.134.0.61, 11.110.0.148, 11.138.1.13
Public exploit
None on Exploit-DB
CISA SSVC
  • Exploitation: none
  • Automatable: no
  • Technical impact: total
?

Decision points from CISA's Vulnrichment, assessed (SSVC 2.0.3).

SSVC documentation

Summary

There is a stored XSS vulnerability allowing arbitrary code execution in the WHM Mass Modify Accounts interface.

Affected versions

  • Webpros cPanel

    fixed in 11.138.0.11; fixed in 11.136.0.45; fixed in 11.134.0.61; fixed in 11.110.0.148

  • Webpros WP Squared

    fixed in 11.138.1.13

References 7

hackerone.com

support.cpanel.net

docs.cpanel.net

docs.wpsquared.com