WebPros vulnerabilities

Exploited WebPros flaws

These are on CISA’s Known Exploited Vulnerabilities list, newest first. If you run any of these products, these come before everything else.

• CVE-2026-41940 WebPros cPanel & WHM and WP2 (WordPress Squared) Missing Authentication for Critical FunctionExploited since Apr 30, 2026 · ransomware · CVSS 9.3

Latest high and critical flaws

• CVE-2026-105474 A server-side template injection exists in SolusVM 2 up to version 2.0.0-44576 that allows remote authenticated users to execute arbitrary code as root.Critical 9.4 · Oct 15, 2026
• CVE-2026-93698 Insufficient validation allows arbitrary commands to be executed via the Multilang adminbin.Critical 9.9 · Oct 2, 2026
• CVE-2026-93697 There is a stored XSS vulnerability allowing arbitrary code execution in the WHM Mass Modify Accounts interface.Critical 9 · Oct 2, 2026
• CVE-2026-93029 There is a stored XSS vulnerability allowing arbitrary code execution in the WHM Manage SSL Hosts interface.Critical 9 · Oct 2, 2026
• CVE-2026-87898 OS command injection in Plesk allows remote authenticated users to execute arbitrary code with root privileges.Critical 9.4 · Sep 23, 2026
• CVE-2026-68492 An untrusted search path vulnerability in Plesk from 18.0.34 before 18.0.80.8 and 18.0.81 before 18.0.81.1 allows remote authenticated users to execute arbitrarHigh 8.7 · Sep 23, 2026
• CVE-2026-68490 Incorrect permission assignment allows local users to obtain sensitive CalDAV/CardDAV information belonging to other accounts.High 8.2 · Sep 23, 2026
• CVE-2026-68491 An insufficient check allowed for the overwrite of arbitrary files via a symlink.Critical 9.4 · Sep 15, 2026
• CVE-2026-68489 Static Code Injection in Plesk extensions "Ruby" before 1.6.6 and "Node.js Toolkit" before 2.5.0 allows remote authenticated users to execute arbitrary code as High 8.7 · Sep 14, 2026
• CVE-2026-67399 Deserialization of untrusted data in WHMCS 9.0.0 before 9.0.8 and 8.0.0 before 8.13.7 allows remote attackers to execute arbitrary code.Critical 9.3 · Sep 14, 2026
• CVE-2026-68488 A Time-of-check Time-of-use (TOCTOU) race condition leading to insecure symlink following in Plesk causes local privilege escalation to root via arbitrary file/Critical 9.9 · Sep 10, 2026
• CVE-2026-68487 Path traversal in Plesk's Backup Manager causes arbitrary file write as root by an authenticated customer.Critical 9.9 · Sep 10, 2026
• CVE-2026-65639 OS command injection in the advanced-rule parser of ConfigServer Security & Firewall allows a remote attacker who controls a configured allow/deny feed to execuCritical 9.5 · Sep 10, 2026
• CVE-2026-65638 Improper escaping of a request URL in ConfigServer Security & Firewall allows an unauthenticated remote attacker to execute arbitrary commands as the CSF serviCritical 9.2 · Sep 10, 2026
• CVE-2026-67402 An insecure Apache configuration in ConfigServer Security & Firewall maps /usr/bin as CGI programs through the Messenger v3 HTTPS virtual host.Critical 9.2 · Sep 3, 2026
• CVE-2026-67398 Missing authorization vulnerability has been discovered in 2Checkout payment gateway of WHMCS from 8.13.0 before 8.13.7, from 9.0.0 before 9.0.8, all other EOL High 8.2 · Sep 3, 2026
• CVE-2026-67397 Path traversal in Plesk 18.0.79.9 and earlier and 18.0.80 through 18.0.80.5 allows local users to execute arbitrary code as root.High 8.5 · Sep 3, 2026
• CVE-2026-67394 A critical local privilege escalation via OS command injection vulnerability has been discovered in Plesk for Linux, affecting all versions from 18.0.34 before Critical 9 · Aug 31, 2026
• CVE-2026-65647 Improper symlink resolution before file access in Plesk allows remote authenticated users to execute arbitrary code as root.High 8.7 · Aug 26, 2026
• CVE-2026-65646 Improper neutralization of special elements in in Plesk's DNS zone management functionality allows remote authenticated users to disclose arbitrary local files Critical 9.9 · Aug 26, 2026
• CVE-2026-65642 Insecure direct object reference in Plesk 18.0.79.7 and earlier or 18.0.80 through 18.0.80.3, allows remote authenticated users to read and modify other customeHigh 8.6 · Aug 26, 2026
• CVE-2026-64639 Incorrect database cloning process in Plesk from 18.0.52 before 18.0.79.6 and 18.0.80.2 allows a low-privileged user (customer, reseller) to execute arbitrary cCritical 9.3 · Aug 12, 2026
• CVE-2026-64637 Improper privilege management in the XML-RPC API of Plesk before 18.0.80, allows an authenticated reseller to obtain an administrative session for the root userCritical 9.9 · Aug 7, 2026
• CVE-2026-64636 An SQL injection vulnerability in Plesk Obsidian up to 18.0.80 for Linux and Windows allows an authenticated user to read arbitrary data from the panel databaseHigh 7.7 · Aug 7, 2026
• CVE-2026-58046 Improper neutralization in the Plesk XML-RPC API allows a remote authenticated low-privileged user to perform SQL injection and read arbitrary data from the PleCritical 9.9 · Jul 30, 2026