Webpros cPanel & WHM: Stored XSS in Mass Modify Accounts interface

Summary

A stored cross-site scripting flaw in the WHM Mass Modify Accounts interface of cPanel & WHM allows an attacker to store a script that runs in the browser of a WHM administrator. Successful exploitation can let the attacker act with the administrator's session, for example to change server settings, manage accounts or alter SSL configuration. The attacker needs a low-privilege WHM account, such as a reseller or hosted customer, and an administrator must open the poisoned page. WP Squared is affected as well.

Affected

• cPanel & WHM 110 before 11.110.0.148
• cPanel & WHM 134 before 11.134.0.61
• cPanel & WHM 136 before 11.136.0.45
• cPanel & WHM 138 before 11.138.0.11
• WP Squared before 11.138.1.13

Fixed in

• cPanel & WHM 110: 11.110.0.148 or later
• cPanel & WHM 134: 11.134.0.61 or later
• cPanel & WHM 136: 11.136.0.45 or later
• cPanel & WHM 138: 11.138.0.11 or later
• WP Squared 138: 11.138.1.13 or later

Workaround

No vendor-documented workaround. Patching is the fix. Compensating controls only:

• Allow access to WHM ports 2086 and 2087 only from administrator IP addresses or a VPN.
• Enforce multi-factor authentication for WHM logins.

Exploitation

• No confirmed exploitation in the wild found in the sources reviewed (early October 2026).
• No public proof-of-concept exploit code confirmed.
• CISA SSVC assessment: exploitation none, not automatable, total technical impact.
• The status may have changed since, so re-check CISA KEV and the vendor advisory.

Our recommendation

• Update cPanel & WHM and WP Squared to the fixed builds listed above, or later.
• Restrict WHM access to administrator IP addresses or a VPN and enable multi-factor authentication.
• Review WHM admin logs, recent account modifications and new privileged accounts for irregular activity.
• Patch the whole cPanel batch in one maintenance window, including CVE-2026-93698, which is rated higher.

Public exploits iAttack code is publicly available (PoC on GitHub, Metasploit or Exploit-DB).

PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.

Research sources

• Webpros security advisory CVE-2026-93697 support.cpanel.net
• cPanel & WHM 110 change log docs.cpanel.net
• cPanel & WHM 134 change log docs.cpanel.net
• cPanel & WHM 136 change log docs.cpanel.net
• cPanel & WHM 138 change log docs.cpanel.net
• WP Squared change log docs.wpsquared.com
• HackerOne report hackerone.com
• VulDB CVE-2026-93697 vuldb.com

Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 31 Oct 2026, 08:17.