Description
There is a stored XSS vulnerability allowing arbitrary code execution in the WHM Manage SSL Hosts interface.
Affected products
Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.
Webpros cPanel
Default version status: unaffected
0 to < 11.138.0.11affected0 to < 11.136.0.45affected0 to < 11.134.0.61affected0 to < 11.110.0.148affected
Webpros WP Squared
Default version status: unaffected
0 to < 11.138.1.13affected
References
- https://hackerone.com/reports/4047106 ↗
- https://support.cpanel.net/hc/en-us/articles/43845929235351-Security-CVE-2026-93029-Stored-XSS-in-WHM-s-Manage-SSL-Hosts-Interface-September-29-2026 ↗
- https://docs.cpanel.net/changelogs/138-change-log/#138011 ↗
- https://docs.cpanel.net/changelogs/136-change-log/#136045 ↗
- https://docs.cpanel.net/changelogs/134-change-log/#134061 ↗
- https://docs.cpanel.net/changelogs/110-change-log/#1100148 ↗
- https://docs.wpsquared.com/changelogs/versions/changelog/#138113 ↗