Webpros cPanel & WHM: Stored cross-site scripting in Manage SSL Hosts

Summary

Stored cross-site scripting (XSS) in the Manage SSL Hosts interface of cPanel & WHM and WP Squared. The CVE record states that it allows arbitrary code execution. An attacker with a low-privileged WHM account and user interaction (for example, an administrator opening a manipulated page) could run attacker-controlled script in the administrative session. CISA's SSVC data rates total technical impact, but no exploitation and no automatable attack path.

Affected

• cPanel & WHM builds before 11.110.0.148
• cPanel & WHM builds before 11.134.0.61
• cPanel & WHM builds before 11.136.0.45
• cPanel & WHM builds before 11.138.0.11
• WP Squared builds before 11.138.1.13
• Other branches: Unknown. Verify your installed build against the vendor advisory.

Fixed in

• cPanel & WHM 11.110.0.148, 11.134.0.61, 11.136.0.45 and 11.138.0.11 (or later builds of the same branch)
• WP Squared 11.138.1.13 (or later)
• Released 2026-09-29 as a targeted security release, according to the cPanel changelogs.

Workaround

Unknown. No vendor-documented workaround was found; patching is the only remedy in the sources.

Exploitation

• No known exploitation in the wild found at the time of research.
• CISA SSVC: Exploitation none, Automatable no.
• vendor statement on the September 2026 batch: no known public exploits or proof-of-concept code (may not be current).

Our recommendation

• Update cPanel & WHM and WP Squared to the fixed builds listed above.
• Check the installed build with the cPanel advisory, since sources disagree on version numbering.
• Review WHM admin sessions and access logs around the patch date for POST requests to Manage SSL Hosts followed by unusual administrative API calls.
• Restrict WHM access to trusted networks and reduce the number of accounts with WHM privileges.

Public exploits iAttack code is publicly available (PoC on GitHub, Metasploit or Exploit-DB).

PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.

Research sources

• cPanel Security advisory CVE-2026-93029 support.cpanel.net
• cPanel 110 Change Log docs.cpanel.net
• cPanel 134 Change Log docs.cpanel.net
• cPanel 136 Change Log docs.cpanel.net
• cPanel 138 Change Log docs.cpanel.net
• WP Squared Changelog docs.wpsquared.com
• HackerOne report hackerone.com
• SentinelOne vulnerability database entry www.sentinelone.com

Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 31 Oct 2026, 08:16.