BaseFortify

Executive Summary

CVE-2026-93029 is a stored cross-site scripting (XSS) vulnerability in WHM's Manage SSL Hosts interface. It allows an unprivileged user to inject malicious scripts that execute in the context of a WHM administrator's session. Successful exploitation could enable the attacker to perform administrative actions as the compromised administrator.

Useful 0 Not Useful 0

Detection Guidance

To detect this stored XSS vulnerability in WHM's Manage SSL Hosts interface, check if your cPanel/WHM version is below the patched versions (11.110.0.148, 11.134.0.61, 11.136.0.45, or 11.138.0.11). Inspect the Manage SSL Hosts interface for unexpected scripts or payloads in input fields or displayed content. Monitor server logs for unusual administrative actions or script executions.

Useful 0 Not Useful 0

Impact Analysis

An attacker could exploit this vulnerability to gain administrative access to WHM, allowing them to perform unauthorized actions such as modifying server configurations, managing user accounts, or accessing sensitive data. This could lead to full system compromise.

Useful 0 Not Useful 0

Compliance Impact

This vulnerability could lead to unauthorized access to sensitive data, violating GDPR's data protection requirements and HIPAA's security rules. Organizations may face compliance violations, legal penalties, and reputational damage if exploited.

Useful 0 Not Useful 0

Mitigation Strategies

Update to the latest patched version of cPanel/WHM (11.110.0.148 or later, 11.134.0.61 or later, 11.136.0.45 or later, or 11.138.0.11 or later) to address the stored XSS vulnerability in WHM's Manage SSL Hosts interface.

Useful 0 Not Useful 0