Stored XSS in WHM Mass Modify Accounts Interface

Executive Summary

CVE-2026-93697 is a stored cross-site scripting (XSS) vulnerability in WHM's Mass Modify Accounts interface. It allows an attacker to inject malicious scripts that execute when viewed by a WHM administrator, potentially enabling unauthorized administrative actions.

Useful 0 Not Useful 0

Detection Guidance

Detection involves checking for unauthorized script injections in WHM's Account Modification Interfaces. Review server logs for suspicious activity in /usr/local/cpanel/logs/access_log and /var/log/nginx/access.log. Look for unusual POST requests to /scripts/manageaccounts or /scripts/edithostname. Use grep to search for script tags in WHM templates: grep -r "<script>" /usr/local/cpanel/base/frontend/

Useful 0 Not Useful 0

Impact Analysis

An attacker could exploit this to execute arbitrary code in the context of a WHM administrator's session. This may allow them to perform administrative actions without proper authorization, leading to potential system compromise or data theft.

Useful 0 Not Useful 0

Compliance Impact

This stored XSS vulnerability in WHM's Account Modification Interfaces could allow unauthorized administrative actions if exploited, potentially leading to unauthorized access to sensitive data. This may violate GDPR's data protection requirements and HIPAA's security rules regarding unauthorized access to protected health information.

Useful 0 Not Useful 0

Mitigation Strategies

Immediately update WHM/cPanel to the latest patched versions (11.110.0.148+, 11.134.0.61+, 11.136.0.45+, or 11.138.0.11+). Disable unprivileged user access to WHM Account Modification Interfaces until patched. Monitor admin sessions for unusual activity and revoke suspicious sessions. Apply temporary WAF rules to block script injection attempts.

Useful 0 Not Useful 0