CVE-2026-93029: WHM Manage SSL Hosts XSS Vulnerability

CVE-2026-93029 Overview

CVE-2026-93029 is a stored cross-site scripting (XSS) vulnerability in the WebHost Manager (WHM) Manage SSL Hosts interface distributed with cPanel. An authenticated attacker can inject malicious script content that executes in the browser context of other WHM users when they view the affected interface. Because WHM operates with administrative privileges over hosted sites, successful exploitation can lead to arbitrary code execution within the management console.

The issue is tracked under CWE-79: Improper Neutralization of Input During Web Page Generation. cPanel addressed the flaw across multiple supported release trains and published a dedicated security advisory.

Critical Impact
Stored XSS in a privileged WHM interface enables arbitrary script execution in administrator sessions, with scope change to hosted customer sites.

Affected Products

cPanel & WHM versions prior to 110.0.148
cPanel & WHM versions prior to 134.0.61, 136.0.45, and 138.0.11
WPSquared versions prior to 138.1.13

Discovery Timeline

2026-10-02 - CVE CVE-2026-93029 published to NVD
2026-10-02 - Last updated in NVD database

Technical Details for CVE-2026-93029

Vulnerability Analysis

The vulnerability resides in the Manage SSL Hosts interface of WHM, the server-level administrative console shipped with cPanel. The interface renders attacker-controlled input without proper output encoding, allowing script payloads to persist in the application state and execute when any administrator loads the affected page.

Because WHM sessions carry root-equivalent authority over the hosting environment, script execution within that context can trigger administrative actions, modify SSL configuration, or pivot into the shell interfaces exposed to WHM. The CVSS vector reflects a scope change, consistent with XSS payloads crossing from the vulnerable component into the browser trust boundary of the viewing administrator.

Root Cause

The underlying defect is improper neutralization of user-supplied input during HTML generation [CWE-79]. Fields processed by the Manage SSL Hosts workflow are reflected back into the interface without context-aware encoding, so markup characters such as <, >, and quote delimiters remain active when the page is rendered.

Attack Vector

Exploitation requires an authenticated session with privileges to submit data processed by the Manage SSL Hosts interface and relies on another WHM user, typically an administrator, subsequently viewing the stored content. The payload executes in the administrator's browser, inheriting WHM session cookies and CSRF-eligible context. From there, an attacker can issue arbitrary WHM API calls or deliver follow-on payloads to hosted accounts.

No verified public exploit code is available. Technical references are limited to the vendor's advisory and the associated HackerOne report #4047106.

Detection Methods for CVE-2026-93029

Indicators of Compromise

Unexpected <script>, onerror, onload, or javascript: strings appearing in SSL host entries, host descriptions, or certificate metadata fields within WHM.
WHM access logs showing POST requests to Manage SSL Hosts endpoints followed by anomalous administrative API calls from the same session.
New or modified SSL host records authored by low-privilege reseller or operator accounts that administrators did not initiate.

Detection Strategies

Inspect stored WHM configuration data for HTML or JavaScript tokens in fields that should contain only hostnames, certificate identifiers, or ASCII metadata.
Correlate WHM audit logs for sequences where a reseller submits SSL host data and an administrator session subsequently performs sensitive actions within a short window.
Monitor browser-side errors or content security policy violations reported by WHM administrators when viewing the Manage SSL Hosts page.

Monitoring Recommendations

Enable and centralize WHM and cPanel access logs, forwarding them to a SIEM for retention and query against the indicators above.
Alert on administrative WHM API usage occurring from the same session that just viewed the Manage SSL Hosts interface, especially account creation or privilege changes.
Track cPanel and WHM package versions across the fleet to confirm every host has moved to a fixed release.

How to Mitigate CVE-2026-93029

Immediate Actions Required

Upgrade cPanel & WHM to a fixed release on the appropriate train: 110.0.148, 134.0.61, 136.0.45, or 138.0.11. WPSquared users should upgrade to 138.1.13 or later.
Review all WHM accounts with privileges to modify SSL host entries and revoke access that is no longer required.
Audit stored SSL host data for script content and remove any entries containing HTML or JavaScript payloads.

Patch Information

Fixes are documented in the cPanel 110 changelog, cPanel 134 changelog, cPanel 136 changelog, cPanel 138 changelog, and the WPSquared 138.1.13 changelog. Apply the update that matches your deployed release train using the standard upcp upgrade process.

Workarounds

Restrict WHM access to a dedicated management network or VPN until patching is complete, reducing exposure to attacker-controlled sessions.
Limit reseller and operator privileges so only trusted operators can author SSL host entries that an administrator will later view.
Require administrators to use isolated browser profiles for WHM access, preventing session reuse across other applications during the exposure window.

bash

# Upgrade cPanel & WHM to the latest patched release on the current tier
/scripts/upcp --force

# Confirm the installed version matches a fixed release
/usr/local/cpanel/cpanel -V