Stored XSS in WHM Manage SSL Hosts Interface

Executive Summary

CVE-2026-93029 is a stored cross-site scripting (XSS) vulnerability in WHM's Manage SSL Hosts interface. It allows an unprivileged user to inject malicious scripts that execute in the context of a WHM administrator's session. Successful exploitation could enable the attacker to perform administrative actions as the compromised administrator.

Useful 0 Not Useful 0

Impact Analysis

An attacker could exploit this vulnerability to gain administrative access to WHM, allowing them to perform unauthorized actions such as modifying server configurations, managing user accounts, or accessing sensitive data. This could lead to full system compromise.

Useful 0 Not Useful 0

Compliance Impact

This vulnerability could lead to unauthorized access to sensitive data, violating GDPR's data protection requirements and HIPAA's security rules. Organizations may face compliance violations, legal penalties, and reputational damage if exploited.

Useful 0 Not Useful 0

Mitigation Strategies

Update to the latest patched version of cPanel/WHM (11.110.0.148 or later, 11.134.0.61 or later, 11.136.0.45 or later, or 11.138.0.11 or later) to address the stored XSS vulnerability in WHM's Manage SSL Hosts interface.

Useful 0 Not Useful 0