CVE-2026-93697

CVE-2026-93697 is a stored cross-site scripting flaw (CWE-79) in the WHM Mass Modify Accounts interface, rated critical (CVSS 3.0 base score 9.0). A low-privileged authenticated user can store malicious content that runs in the browser of an administrator who later opens that interface, and the advisory describes the impact as arbitrary code execution with high confidentiality, integrity, and availability impact and a changed scope. WHM is the administrative console for cPanel hosting servers, so compromise of an admin session can expose the accounts and configuration that console controls. No affected version range is stated in the CVE data. It is not listed in CISA KEV, and no public proof-of-concept is known.

What to do: Treat WHM as an admin control plane: restrict ports 2086/2087 to trusted management networks, limit who can use Mass Modify Accounts, and review that interface for unexpected stored account data. Apply the vendor fix as soon as cPanel publishes one for this CVE; no fixed version is identified in the current advisory data. Until then, assume a low-privilege authenticated user can plant content that runs when an administrator opens the page.