Stored XSS in WHM admin interface for widely used cPanel/WHM; can lead to admin session compromise across hosting providers and customer sites.
CVE-2026-93029
Stored XSS in cPanel/WHM Manage SSL Hosts allowing script execution in admin sessions.
Is CVE-2026-93029 being exploited?
Not confirmed. CVE-2026-93029 does not appear in CISA's Known Exploited Vulnerabilities catalog, which records only exploitation that has been observed and reported publicly. That is evidence of absence of a report, not evidence the flaw is unattacked.
How severe is CVE-2026-93029?
CVE-2026-93029 is rated Critical with a CVSS score of 9.0. Severity describes how bad exploitation would be, not how likely it is: pair it with exploitation evidence before deciding what to patch first.
Is there a patch for CVE-2026-93029?
Yes. A fix has been recorded for CVE-2026-93029. The vendor advisory is the authority on the exact fixed version — apply it from there rather than from a summary.
What does CVE-2026-93029 affect?
CVE-2026-93029 affects cPanel/WHM Manage SSL Hosts interface, WHM admin consoles on hosted servers, Hosting providers using cPanel. Confirm the exact affected versions against the vendor advisory before deciding you are exposed.
What should I do about CVE-2026-93029?
Apply vendor cPanel/WHM updates immediately; restrict WHM access and rotate admin credentials.
Exploitation status reflects CISA's KEV catalog as we last synced it. Check the catalog directly.
Stored XSS lets attackers execute JavaScript in WHM admin browsers to steal cookies, hijack admin accounts and perform admin actions.
Immediate action required