wp_squared vulnerabilities
CVEs whose affected-version data names the wp_squared package. Each record lists the affected and patched versions; check a specific version with the dependency checker or POST /api/sbom.
4 CVEsRSS
CVE-2026-93698Critical· 9.9Insufficient validation allows arbitrary commands to be executed via the Multilang adminbin.
Insufficient validation allows arbitrary commands to be executed via the Multilang adminbin.
▾ MidnightWebpros · cPanelEPSS 0.63%via NVD
CVE-2026-93697Critical· 9.0There is a stored XSS vulnerability allowing arbitrary code execution in the WHM Mass Modify Accounts interface.
There is a stored XSS vulnerability allowing arbitrary code execution in the WHM Mass Modify Accounts interface.
▾ MidnightWebpros · cPanelEPSS 0.55%via NVD
CVE-2026-93029Critical· 9.0There is a stored XSS vulnerability allowing arbitrary code execution in the WHM Manage SSL Hosts interface.
There is a stored XSS vulnerability allowing arbitrary code execution in the WHM Manage SSL Hosts interface.
▾ MidnightWebpros · cPanelEPSS 0.55%via NVD
CVE-2026-41940Critical· 9.8CISA KEV0dayPoCcPanel and WHM versions after 11.40 contain an authentication bypass vulnerability in the login flow that allows unauthenticated remote attackers to gain unauthorized access to the control panel.
cPanel and WHM versions after 11.40 contain an authentication bypass vulnerability in the login flow that allows unauthenticated remote attackers to gain unauthorized access to the control panel.
▾ Hadalcpanel · cpanelEPSS 99%via NVD