WebPros WP Squared

• CVE-2026-41940 Critical 9.8 Exploited WebPros cPanel and WHM Authentication Bypass via Login Flow 98.5%
• CVE-2026-93029 Critical 9.0 There is a stored XSS vulnerability allowing arbitrary code execution in the WHM Manage SSL Hosts interface. 0.5%
• CVE-2026-93697 Critical 9.0 There is a stored XSS vulnerability allowing arbitrary code execution in the WHM Mass Modify Accounts interface. 0.5%
• CVE-2026-93698 Critical 9.9 Insufficient validation allows arbitrary commands to be executed via the Multilang adminbin. 0.6%
• CVE-2026-58048 Critical 9.4 Improper preservation of SQL mode when renaming databases in cPanel allows execution of SQL in root context. 0.6%
• CVE-2026-58047 Medium 5.6 HTTP Smuggling in cPanel allows potential leak of credentials. 0.5%
• CVE-2026-29206 High 8.1 Insufficient sanitization of SQL queries in the `sqloptimizer` utility script allows SQL Injections on behalf of the root user if Slow Query logging is enabled. 0.3%
• CVE-2026-32991 High 7.1 Improper authorization checks of team members privileges allow a team member to escalate privileges to the team owner account. 0.2%
• CVE-2026-29205 High 8.6 Incorrect privileges management and insufficient path filtering allow to read arbitrary file on the server via the cpdavd attachment download endpoints. 8.4%
• CVE-2026-32992 High 8.2 SSL verification is disabled in the DNS Cluster system. This could allow for a malicious server to man-in-the-middle the request and capture credentials. 0.3%
• CVE-2026-32993 High 8.3 Improper sanitization of the `status` query parameter of the `/unprotected/nova_error` endpoint allows unauthenticated attacker to inject arbitrary HTTP header to the response. 0.3%
• CVE-2026-29201 High 8.6 Insufficient input validation of the feature file name in `feature::LOADFEATUREFILE` adminbin call can cause arbitrary file read when a relative file path is passed. 0.4%
• CVE-2026-29202 High 8.8 Insufficient input validation of the `plugin` parameter of the `create_user` plugin allows arbitrary Perl code execution on behalf of the already authenticated account's system user. 1.9%
• CVE-2026-29203 High 8.8 A chmod call in the cPanel Nova plugin's Cpanel::Nova::Connector follows symlinks, allowing setting root permissions on arbitrary system files or directories. That can cause DoS or local privilege esc 0.5%