WP Squared

Search everything

Mentions · 7d0
Mentions · 30d0
All mentions5
First seenSep 21, 2026
Last mentionedOct 2, 2026

Timeline

5 articles · newest first

Multiple cPanel & WHM Vulnerabilities Enable Root Code Execution and Admin Session Hijacking

cPanel patched a critical root command-execution flaw and two WHM stored XSS bugs across supported versions.

GBHackersOct 2, 11:26 UTC · Oct 2, 2026VulnerabilityCVE-2026-93698 CVE-2026-93029 CVE-2026-936972 · 1 read

cPanel Permissions Flaw Allows Local Users to Read Other Accounts’ Calendar Data

cPanel patched CVE-2026-68490, which lets local users on shared servers read other accounts' calendars and contacts.

GBHackersSep 24, 07:08 UTC · Sep 24, 2026VulnerabilityCVE-2026-684902 · 1 read

New Cpanel Vulnerability Allows Attackers to Access Other Users’ Accounts

cPanel patched a root privilege escalation and cross-tenant flaws in calendars, contacts, and WordPress databases.

Cyber Security NewsSep 23, 15:18 UTC · Sep 23, 2026VulnerabilityCVE-2026-68490 CVE-2026-87899 CVE-2026-87900+34 · 2 reads

New cPanel Flaw Lets a Hosting Account Run Code as Root, Take Full Server Control

cPanel patched three flaws, including a root code-execution bug any hosting account can use to seize the server.

The Hacker NewsSep 23, 12:16 UTC · Sep 23, 2026VulnerabilityCVE-2026-87899 CVE-2026-87900 CVE-2026-684904 · 1 read

Hackers Abuse Critical cPanel Authentication Bypass to Compromise Hosting Servers

Attackers exploited critical cPanel CVE-2026-41940 on hosting servers, deploying Mirai variants and ransomware.

GBHackersSep 21, 05:06 UTC · Sep 21, 2026Exploit / PoCExploitedCVE-2026-419406 · 2 reads

Related CVEs

by mentions

CVE-2026-684908.2
CalDAV/CardDAV Permission Flaw in cPanel Lets Local Users Read Other Accounts' Data
published Sep 23, 2026cPanel (cPanel, L.L.C. / WebPros) cPanel & WHM (CalDAV/CardDAV calendar and contacts service)
CVE-2026-878999.4
Authenticated Privilege Escalation to Root RCE in cPanel & WHM
published Sep 23, 2026cPanel, L.L.C. cPanel & WHM
CVE-2026-879009.4
Argument Injection in WP Toolkit for cPanel Allows Cross-Account File Read and RCE
published Sep 23, 2026Plesk / WebPros (WP Toolkit) WP Toolkit for cPanel
CVE-2026-4194099%9.3
Missing-Authentication Bypass in WebPros cPanel & WHM (AuthBypass to RCE)
published Apr 29, 2026WebPros cPanelKEVRansomwarePoC ×9
CVE-2026-67401<1%9.9
Authenticated SQL Injection in cPanel EmailTrack Leads to Root RCE
published Sep 9, 2026cPanel (WebPros) cPanelPoC ×5
CVE-2026-936989.9
Authenticated OS command injection in Multilang adminbin
published Oct 2, 2026Multilang adminbin
CVE-2026-656389.2
Unauthenticated shell command injection in ConfigServer Security & Firewall (CSF)
published Sep 10, 2026ConfigServer Security & Firewall (CSF)
CVE-2026-936979.0
Stored XSS in WHM Mass Modify Accounts
published Oct 2, 2026cPanel WHM (WebHost Manager) Mass Modify Accounts
CVE-2026-930299.0
Stored XSS in cPanel WHM Manage SSL Hosts
published Oct 2, 2026cPanel WHM (WebHost Manager) Manage SSL Hosts
CVE-2026-65643<1%8.7
Authenticated eval injection in cPanel enables root code execution
published Sep 1, 2026cPanel

Appears with

cPanelvendor · 5
WHMproduct · 4
cPanelproduct · 4
cPanelorganization · 3
WP Toolkitproduct · 2
cPanel & WHMproduct · 1
LiteSpeedvendor · 1
Pleskproduct · 1
JPCERT/CCorganization · 1
NVDorganization · 1
LiteSpeed Enterpriseproduct · 1
Censysorganization · 1
WebProsorganization · 1
NICTERorganization · 1
ConfigServervendor · 1
WebProsvendor · 1

Entities are extracted by the model from each article. First seen Sep 21, 2026, last mentioned Oct 2, 2026. Watching keeps it in this browser only (no account); the watchlist page and dashboard alerts use it.