CVE-2026-93697: WHM Mass Modify Accounts XSS Vulnerability

CVE-2026-93697 Overview

CVE-2026-93697 is a stored cross-site scripting (XSS) vulnerability in the WebHost Manager (WHM) Mass Modify Accounts interface in cPanel. An authenticated attacker with low privileges can inject malicious script content that executes in the browser of other WHM users. Because the WHM interface is used by server administrators and resellers, successful exploitation can lead to arbitrary code execution within an administrative session. The flaw is tracked under CWE-79 (Improper Neutralization of Input During Web Page Generation).

Critical Impact
Attackers can hijack administrative WHM sessions and perform arbitrary actions on hosted accounts after a WHM administrator views the poisoned Mass Modify Accounts page.

Affected Products

cPanel/WHM versions addressed in change logs 110.0.0.148, 134.0.0.61, 136.0.0.45, and 138.0.0.11
WPSquared platform referenced in change log 138.0.0.113
WHM Mass Modify Accounts and related Account Modification interfaces

Discovery Timeline

2026-10-02 - CVE-2026-93697 published to the National Vulnerability Database (NVD)
2026-10-02 - Last updated in NVD database

Technical Details for CVE-2026-93697

Vulnerability Analysis

The vulnerability resides in the WHM Mass Modify Accounts interface, which allows resellers and administrators to update settings for multiple hosted accounts at once. Account-related fields rendered in this interface are not properly neutralized before being written back into the HTML response. An attacker who controls data that reaches the Mass Modify Accounts view can store HTML or JavaScript payloads that execute when another WHM user loads the page.

Because the payload runs inside an authenticated WHM context, it inherits the privileges of the viewing operator. A reseller account can target a root-equivalent WHM administrator and effectively obtain arbitrary code execution within the WHM session. The CVSS vector indicates a scope change, reflecting that the impact extends beyond the attacker's own authorization boundary into the administrator's account.

Root Cause

The root cause is improper output encoding of account attributes rendered in the Mass Modify Accounts interface. Stored input containing HTML control characters such as <, >, ", and ' is reflected into the DOM without context-appropriate escaping, allowing script content to be parsed and executed by the browser.

Attack Vector

The attack is network-reachable and requires an authenticated low-privilege WHM user plus interaction from a victim administrator who opens the affected page. A reseller or operator with the ability to influence account fields injects a script payload. When a higher-privileged WHM user navigates to the Mass Modify Accounts interface and the record is rendered, the payload executes and can issue authenticated WHM API calls, create accounts, or modify server configuration.

No verified exploitation code is published. See the cPanel Security Advisory for CVE-2026-93697 and the HackerOne Report #4047787 for additional technical context.

Detection Methods for CVE-2026-93697

Indicators of Compromise

Account metadata fields (contact email, notes, custom attributes) that contain <script>, onerror=, javascript:, or encoded HTML entities
WHM access logs showing requests to Mass Modify Accounts endpoints followed by anomalous WHM API calls from the same session
Unexpected creation or modification of WHM accounts, API tokens, or reseller privileges shortly after an administrator used the Mass Modify Accounts interface

Detection Strategies

Audit stored account fields in the cPanel user database for HTML and JavaScript syntax that should not appear in normal metadata
Review web server access logs for POST requests to account modification endpoints originating from reseller-level accounts
Correlate browser-side errors or Content Security Policy (CSP) violations reported by WHM administrators with usage of the Mass Modify Accounts interface

Monitoring Recommendations

Enable and centralize cPanel and WHM access logs, including /usr/local/cpanel/logs/access_log and error_log
Alert on new WHM API tokens, privilege changes, or bulk account modifications performed within short time windows
Monitor reseller activity for input fields containing script tags or unusual encoded payloads

How to Mitigate CVE-2026-93697

Immediate Actions Required

Update cPanel and WHM to a build that includes the fixes referenced in cPanel change logs 110.0.0.148, 134.0.0.61, 136.0.0.45, and 138.0.0.11
Review all reseller accounts and revoke access for any that are untrusted or no longer required
Rotate WHM API tokens and administrative passwords if indicators of compromise are observed

Patch Information

cPanel addressed the vulnerability across multiple maintained release tiers. Refer to cPanel Change Log 110, Change Log 134, Change Log 136, and Change Log 138. WPSquared users should apply the fix documented in the WPSquared Change Log 138. Review the cPanel Security Advisory for CVE-2026-93697 for upgrade guidance.

Workarounds

Restrict access to the WHM Mass Modify Accounts interface to trusted administrators until patches are applied
Limit reseller privileges that allow modification of account attributes rendered by the interface
Enforce a strict Content Security Policy on WHM to reduce the impact of injected scripts

bash

# Update cPanel/WHM to the latest patched build
/usr/local/cpanel/scripts/upcp --force

# Verify the installed cPanel version against the fixed releases
/usr/local/cpanel/cpanel -V