Vulnerability database

7 results

• Jun 15, 2026LiteSpeed cPanel Plugin UNIX Symbolic Link (Symlink) Following VulnerabilityCVE-2026-54420 · Other software · LiteSpeed · reported by MITREExploitedHigh 8.5

  LiteSpeed cPanel plugin contains a UNIX symbolic link (Symlink) following vulnerability that could allow a user with FTP or web shell access on a shared hosting server running CloudLinux/CageFS.

  Product

  cPanel Plugin

  On CISA’s list since

  Jun 15, 2026 (federal fix deadline Jun 18, 2026)

  What to do

  Attackers are using this now. Install LiteSpeed’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.

  Full record and what to do →NVD recordCISA catalogblog.litespeedtech.comlitespeedtech.com

• May 26, 2026LiteSpeed cPanel Plugin Privilege Escalation VulnerabilityCVE-2026-48172 · Other software · LiteSpeed · reported by MITREExploitedCritical 10

  LiteSpeed cPanel Plugin contains privilege escalation vulnerability that is exposed via the user-end cPanel plugin, which can be abused by any cPanel user account to execute arbitrary scripts with root privileges.

  Product

  cPanel Plugin

  On CISA’s list since

  May 26, 2026 (federal fix deadline May 29, 2026)

  What to do

  Attackers are using this now. Install LiteSpeed’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.

  Full record and what to do →NVD recordCISA catalogblog.litespeedtech.comlitespeedtech.com

• Apr 30, 2026WebPros cPanel & WHM and WP2 (WordPress Squared) Missing Authentication for Critical Function VulnerabilityCVE-2026-41940 · WordPress plugins & themes · reported by VulnCheckExploitedRansomwareCritical 9.3

  WebPros cPanel & WHM (WebHost Manager) and WP2 (WordPress Squared) contain an authentication bypass vulnerability in the login flow that allows unauthenticated remote attackers to gain unauthorized access to the control panel.

  Product

  cPanel & WHM and WP2 (WordPress Squared)

  On CISA’s list since

  Apr 30, 2026 (federal fix deadline May 3, 2026)

  What to do

  Attackers are using this now. Install WebPros’s update today (ransomware groups use this one). If there is no update for your version, take the product off the internet or stop using it until there is.

  Full record and what to do →NVD recordCISA catalogdocs.cpanel.netdocs.wpsquared.com

• Nov 4, 2025CWP Control Web Panel OS Command Injection VulnerabilityCVE-2025-48703 · Other software · CWP · reported by MITREExploitedCritical 9

  CWP Control Web Panel (formerly CentOS Web Panel) contains an OS command Injection vulnerability that allows unauthenticated remote code execution via shell metacharacters in the t_total parameter in a filemanager changePerm request. A valid non-root username must be known.

  Product

  Control Web Panel

  On CISA’s list since

  Nov 4, 2025 (federal fix deadline Nov 25, 2025)

  What to do

  Attackers are using this now. Install CWP’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.

  Full record and what to do →NVD recordCISA catalogfenrisk.comcontrol-webpanel.com

• Dec 4, 2024CyberPanel Incorrect Default Permissions VulnerabilityCVE-2024-51378 · Other software · CyberPersons · reported by MITREExploitedRansomwareCritical 10

  CyberPanel contains an incorrect default permissions vulnerability that allows for authentication bypass and the execution of arbitrary commands using shell metacharacters in the statusfile property.

  Product

  CyberPanel

  On CISA’s list since

  Dec 4, 2024 (federal fix deadline Dec 25, 2024)

  What to do

  Attackers are using this now. Install CyberPersons’s update today (ransomware groups use this one). If there is no update for your version, take the product off the internet or stop using it until there is.

  Full record and what to do →NVD recordCISA catalogcwe.mitre.orgcwe.mitre.org

• Nov 7, 2024CyberPanel Incorrect Default Permissions VulnerabilityCVE-2024-51567 · Other software · CyberPersons · reported by MITREExploitedRansomwareCritical 10

  CyberPanel contains an incorrect default permissions vulnerability that allows a remote, unauthenticated attacker to execute commands as root.

  Product

  CyberPanel

  On CISA’s list since

  Nov 7, 2024 (federal fix deadline Nov 28, 2024)

  What to do

  Attackers are using this now. Install CyberPersons’s update today (ransomware groups use this one). If there is no update for your version, take the product off the internet or stop using it until there is.

  Full record and what to do →NVD recordCISA catalogcwe.mitre.orgcwe.mitre.org

• Jan 17, 2023CWP Control Web Panel OS Command Injection VulnerabilityCVE-2022-44877 · Other software · CWP · reported by MITREExploitedCritical 9.8

  CWP Control Web Panel (formerly CentOS Web Panel) contains an OS command injection vulnerability that allows remote attackers to execute commands via shell metacharacters in the login parameter.

  Product

  Control Web Panel

  On CISA’s list since

  Jan 17, 2023 (federal fix deadline Feb 7, 2023)

  What to do

  Attackers are using this now. Install CWP’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.

  Full record and what to do →NVD recordCISA catalogpacketstormsecurity.compacketstormsecurity.com

Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.