cPanel EUVD-2026-91200

Exploitation requires an authenticated foothold (CVSS PR:L) - the attacker must control an account that can create or modify an SSL host entry rendered in WHM's Manage SSL Hosts interface - and requires user interaction (UI:R): a higher-privileged operator, typically a server administrator, must subsequently view that interface for the stored payload to fire. The affected surface is specifically the WHM Manage SSL Hosts feature in cPanel and WP Squared. Limiting factors: the need for prior authenticated access and for an administrator to view the poisoned interface means this is not remotely exploitable against a default install without an account; however, in multi-tenant/reseller hosting environments where low-privileged accounts are routine, that barrier is low. Fixed in cPanel builds 11.110.0.148, 11.134.0.61, 11.136.0.45, 11.138.0.11 and WP Squared 11.138.1.13.

This is a genuinely high-priority issue, though not an unauthenticated drive-by. The CVSS 3.0 vector (AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:H, base 9.0) shows a network-reachable, low-complexity flaw that nonetheless requires some privilege (PR:L - an authenticated account such as a reseller or limited WHM user) and user interaction (UI:R - a higher-privileged operator must view the malicious SSL host entry). The scope change (S:C) is the key multiplier: a stored XSS payload in WHM's Manage SSL Hosts interface executes in the context of a server administrator and, per the description and the RCE tag, escalates to arbitrary code execution on the hosting server - breaching the browser-to-server boundary. Signals are incomplete: no EPSS score, no CISA KEV listing, and no public POC were provided, so there is no public exploit identified at time of analysis and no evidence of active or widespread exploitation. The high CVSS is therefore driven by impact and scope rather than by confirmed exploitation; treat it as a high-impact, patch-now issue for cPanel/WHM operators, but note that the PR:L + UI:R preconditions make opportunistic mass exploitation less likely than a critical pre-auth flaw. EPSS being absent (not low) means probabilistic exploitation likelihood is simply unknown, not benign.

A low-privileged but authenticated cPanel/WHM user (e.g. a reseller or limited account) injects a malicious script payload into an SSL host entry that is stored and later rendered in WHM's Manage SSL Hosts interface. When a server administrator views that interface, the stored script executes in their authenticated session, and per the advisory this leads to arbitrary code execution on the server. No public exploit code was identified at time of analysis.