CVE-2026-93697

Published: Oct 2, 2026Modified: Oct 2, 2026Deferred

9.0

Vector

CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:H

Exploitability: 2.3 / Impact: 6.0

Source: support@hackerone.com (Secondary)

Description

There is a stored XSS vulnerability allowing arbitrary code execution in the WHM Mass Modify Accounts interface.

Related CWEs

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

References (7)

https://docs.cpanel.net/changelogs/110-change-log/#1100148

Source: support@hackerone.com

https://docs.cpanel.net/changelogs/134-change-log/#134061

Source: support@hackerone.com

https://docs.cpanel.net/changelogs/136-change-log/#136045

Source: support@hackerone.com

https://docs.cpanel.net/changelogs/138-change-log/#138011

Source: support@hackerone.com

https://docs.wpsquared.com/changelogs/versions/changelog/#138113

Source: support@hackerone.com

https://hackerone.com/reports/4047787

Source: support@hackerone.com

https://support.cpanel.net/hc/en-us/articles/43845930445207-Security-CVE-2026-93697-Stored-XSS-in-WHM-s-Account-Modification-Interfaces-September-29-2026

Source: support@hackerone.com

Timeline

No history available yet.