CVE-2026-93697

{
  "etk_id": "ETK-2026-315",
  "cve_id": "CVE-2026-93697",
  "display_id": "CVE-2026-93697",
  "ghsa_id": "GHSA-jc78-m6vr-f88f",
  "euvd_id": "EUVD-2026-91199",
  "status": "published",
  "anchor_state": "anchored",
  "title": "Stored cross-site scripting in cPanel WHM account management",
  "summary": "Affected cPanel and WP Squared releases contain a persistent cross-site scripting flaw in WHM's Mass Modify Accounts interface. An attacker able to store malicious content that is later opened in this interface may execute code in the viewing user's browser; the required attacker privileges are not stated.",
  "mitigation": "Upgrade cPanel to 11.138.0.11, 11.136.0.45, 11.134.0.61, or 11.110.0.148, as appropriate for your release track. Upgrade WP Squared to 11.138.1.13.",
  "vendor": "Webpros",
  "product": "cPanel",
  "affected": [
    {
      "affected_notes": [],
      "affected_ranges": [
        ">= 0, < 11.138.0.11",
        ">= 0, < 11.136.0.45",
        ">= 0, < 11.134.0.61",
        ">= 0, < 11.110.0.148"
      ],
      "ecosystem": null,
      "fixed_versions": [
        "11.138.0.11",
        "11.136.0.45",
        "11.134.0.61",
        "11.110.0.148"
      ],
      "package_name": "cPanel",
      "purl": null
    },
    {
      "affected_notes": [],
      "affected_ranges": [
        ">= 0, < 11.138.1.13"
      ],
      "ecosystem": null,
      "fixed_versions": [
        "11.138.1.13"
      ],
      "package_name": "WP Squared",
      "purl": null
    }
  ],
  "cwes": [
    79
  ],
  "cvss_score": 9,
  "cvss_src": "cna_vendor",
  "cvss_vector": "CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:H",
  "epss_score": 0.0052,
  "epss_percentile": 0.4303,
  "epss_asof": "2026-10-20",
  "automation": "contextual",
  "check": false,
  "check_confidence_basis": null,
  "exploit": false,
  "pipeline_minutes": 18.9727635,
  "t0_at": "2026-10-02T06:20:44.084000+00:00",
  "signals": {
    "trigger_signal": {
      "at": "2026-10-02T06:20:44.084000+00:00",
      "days": 0,
      "is_lower_bound": false,
      "measured_at": "2026-10-02T06:20:44.084000+00:00",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-93697"
    }
  }
}