Description
There is a stored XSS vulnerability allowing arbitrary code execution in the WHM Mass Modify Accounts interface.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| Webpros | cPanel | < 11.138.0.11, < 11.136.0.45, < 11.134.0.61, < 11.110.0.148 | 11.138.0.11 |
| Webpros | WP Squared | < 11.138.1.13 | 11.138.1.13 |
Advisories 1
- WID-SEC-2026-3698 cPanel cPanel/WHM: Mehrere Schwachstellen BSI CERT-Bund (WID) · Oct 1, 2026
References
- https://hackerone.com/reports/4047787
- https://support.cpanel.net/hc/en-us/articles/43845930445207-Security-CVE-2026-93697-Stored-XSS-in-WHM-s-Account-Modification-Interfaces-September-29-2026
- https://docs.cpanel.net/changelogs/138-change-log/#138011
- https://docs.cpanel.net/changelogs/136-change-log/#136045
- https://docs.cpanel.net/changelogs/134-change-log/#134061
- https://docs.cpanel.net/changelogs/110-change-log/#1100148
- https://docs.wpsquared.com/changelogs/versions/changelog/#138113