cPanel WHM CVE-2026-93697

Exploitation requires an authenticated WHM account with sufficient privilege (PR:L - e.g., a reseller or delegated operator) to submit data through the WHM Mass Modify Accounts / Account Modification interface and store a script payload. Execution is gated by victim interaction (UI:R): a higher-privileged WHM operator must subsequently open the affected account-modification interface in their browser for the stored payload to fire. Limiting factors: this is not remote-unauthenticated - an attacker needs a valid low-privilege WHM foothold and must wait for a privileged user to view the tainted interface, which constrains reliability and rules out spray-style mass exploitation. Affected builds are cPanel below 11.110.0.148, 11.134.0.61, 11.136.0.45, and 11.138.0.11, and WP Squared below 11.138.1.13.

This is a genuinely high-priority issue, though its real-world risk is shaped more by access prerequisites than by the headline 9.0 score. The CVSS:3.0 vector (AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:H) describes a network-reachable, low-complexity stored XSS that requires an authenticated low-privilege actor (PR:L) to plant the payload and a victim operator to view the affected interface (UI:R). The scope change (S:C) and C:H/I:H/A:H impacts reflect that injected script executes in the browser context of a higher-privileged WHM operator, enabling account-management actions on their behalf - hence the vendor's and tags' characterization as leading to 'arbitrary code execution.' Note that CWE-79 and the description point to client-side script execution rather than true server-side RCE, so the 'RCE' framing should be read as session/privilege abuse within WHM, not native code on the host. No EPSS score, no CISA KEV listing, and no confirmed public POC were provided, so there is no signal of active or widespread exploitation; the HackerOne origin suggests coordinated disclosure rather than in-the-wild use. The combination of a required authenticated foothold plus victim interaction meaningfully lowers mass-exploitation likelihood relative to the raw score, but in multi-tenant hosting environments where low-privilege/reseller accounts are common, the privilege-escalation potential makes patching urgent.

A low-privilege WHM user (e.g., a reseller) with access to account data injects a malicious script payload into a field processed by the Mass Modify Accounts interface. When a higher-privileged WHM operator later opens the Account Modification interface, the stored script executes in their authenticated browser session, allowing the attacker to hijack the session or perform privileged account-management actions. No confirmed public POC was provided, though the issue was reported through HackerOne.