[ Vendor · 11 CVEs ]
WebPros
CVEs affecting WebPros published in the last 30 days, plus any WebPros CVE on CISA's exploited list.
| CVE | Published | Severity | Vulnerability | Signals |
|---|---|---|---|---|
| CVE-2026-105474 | 15 Oct 2026 | CVSS 9.4 | WebPros SolusVM 2A server-side template injection exists in SolusVM 2 up to version 2.0.0-44576 that allows remote authenticated users to execute arbitrary code as… | |
| CVE-2026-93699 | 8 Oct 2026 | CVSS 8.5 | WebPros WP ToolkitArgument injection in WP Toolkit for cPanel allows local users to execute arbitrary code as other accounts on the same server. | |
| CVE-2026-93698 | 2 Oct 2026 | CVSS 9.9 | Webpros cPanelInsufficient validation allows arbitrary commands to be executed via the Multilang adminbin. | |
| CVE-2026-93029 | 2 Oct 2026 | CVSS 9.0 | Webpros cPanelThere is a stored XSS vulnerability allowing arbitrary code execution in the WHM Manage SSL Hosts interface. | |
| CVE-2026-93697 | 2 Oct 2026 | CVSS 9.0 | Webpros cPanelThere is a stored XSS vulnerability allowing arbitrary code execution in the WHM Mass Modify Accounts interface. | |
| CVE-2026-87898 | 23 Sep 2026 | CVSS 9.4 | WebPros Plesk extension "Site Import"OS command injection in Plesk allows remote authenticated users to execute arbitrary code with root privileges. | |
| CVE-2026-87899 | 23 Sep 2026 | CVSS 9.4 | WebPros cPanelExecution with unnecessary privileges in cPanel allows remote authenticated users to execute arbitrary code with root privileges. | |
| CVE-2026-87900 | 23 Sep 2026 | CVSS 9.4 | WebPros WP Toolkit for cPanelArgument injection in WP Toolkit for cPanel 6.11.2-10794 and earlier allows remote authenticated users to read arbitrary files and execute arbitrary… | |
| CVE-2026-68490 | 23 Sep 2026 | CVSS 8.2 | WebPros cPanelIncorrect permission assignment allows local users to obtain sensitive CalDAV/CardDAV information belonging to other accounts. | |
| CVE-2026-68492 | 23 Sep 2026 | CVSS 8.7 | WebPros PleskAn untrusted search path vulnerability in Plesk from 18.0.34 before 18.0.80.8 and 18.0.81 before 18.0.81.1 allows remote authenticated users to… | |
| CVE-2026-41940 | 29 Apr 2026 | CVSS 9.8 | WebPros cPanel & WHM and WP2 (WordPress Squared) Missing Authentication for Critical FunctioncPanel and WHM versions after 11.40 contain an authentication bypass vulnerability in the login flow that allows unauthenticated remote attackers to… | Exploited |