CRITICAL 9.0 NVD
CVE-2026-93697
There is a stored XSS vulnerability allowing arbitrary code execution in the WHM Mass Modify Accounts interface.
There is a stored XSS vulnerability allowing arbitrary code execution in the WHM Mass Modify Accounts interface.
References
- https://docs.cpanel.net/changelogs/110-change-log/#1100148
- https://docs.cpanel.net/changelogs/134-change-log/#134061
- https://docs.cpanel.net/changelogs/136-change-log/#136045
- https://docs.cpanel.net/changelogs/138-change-log/#138011
- https://docs.wpsquared.com/changelogs/versions/changelog/#138113
This critical severity vulnerability with a CVSS score of 9.0 was published on 2026-10-02 via NVD.
Risk Timeline
CVE Disclosed2026-10-02 · -1 days ago
Remediation Resources
Analysis & PoC
docs.cpanel.net/changelogs/110-change-log/#1100148Analysis & PoC
docs.cpanel.net/changelogs/134-change-log/#134061
vulnfeed aggregates 10476 vulnerabilities from NVD, CISA KEV,
Ubuntu, Debian, Red Hat, Kubernetes, Exploit-DB, OSS-Security, GitHub and OpenStack — updated every 4 hours.