Vendor
WebPros
49 known vulnerabilities in products by WebPros, 1 of them actively exploited (CISA KEV).
Key figures
49
Vulnerabilities
1
Actively exploited (KEV)
1
Used by ransomware
29
Critical
Vulnerabilities
Actively exploited vulnerabilities (CISA KEV) first, then by priority. Click a column header to re-sort the table.
| Critical | CVE-2026-41940 | WebPros cPanel and WHM Authentication Bypass via Login Flow In CISA KEVRansomwarealso in 3 other products | 9.8 | |
| High | CVE-2026-29205 | WebPros cPanel: Execution with Unnecessary Privileges | 8.6 | |
| Critical | CVE-2026-65638 | WebPros ConfigServer Security & Firewall: OS Command Injection | — | |
| Critical | CVE-2026-65639 | WebPros ConfigServer Security & Firewall: OS Command Injection | — | |
| High | CVE-2026-29202 | WebPros cPanel: Code Injection | 8.8 | |
| Critical | CVE-2026-87898 | WebPros Plesk extension "Site Import": OS Command Injection | — | |
| Critical | CVE-2026-67394 | WebPros Plesk: OS Command Injection | — | |
| Critical | CVE-2026-67401 | WebPros cPanel: SQL Injection | 9.9 | |
| Critical | CVE-2026-93698 | Webpros cPanel: OS Command Injection | 9.9 | |
| Critical | CVE-2026-67399 | WebPros WHMCS: Deserialization of Untrusted Data | — | |
| Critical | CVE-2026-87900 | WebPros WP Toolkit for cPanel: Argument Injection | — | |
| High | CVE-2026-65643 | WebPros cPanel: Eval Injection | 8.8 | |
| Critical | CVE-2026-68487 | WebPros Plesk: Absolute Path Traversal | 9.9 | |
| Critical | CVE-2026-65646 | WebPros Plesk: Injection | 9.9 | |
| Critical | CVE-2026-87899 | WebPros cPanel: Execution with Unnecessary Privileges | — | |
| High | CVE-2026-68492 | WebPros Plesk: Untrusted Search Path | — | |
| High | CVE-2026-68489 | WebPros Plesk extension "Ruby": Static Code Injection | — | |
| High | CVE-2026-65647 | WebPros Plesk Migrator: Link Following | — | |
| Critical | CVE-2026-93029 | Webpros cPanel: Cross-site Scripting | 9.0 | |
| Critical | CVE-2026-93697 | Webpros cPanel: Cross-site Scripting | 9.0 | |
| Critical | CVE-2026-105474 | WebPros SolusVM 2: Improper Neutralization of Special Elements Used in a Template Engine | — | |
| Critical | CVE-2026-56843 | Webpros Plesk: Insufficiently Protected Credentials | 9.9 | |
| Critical | CVE-2026-44962 | WebPros Plesk: XPath Injection | 9.9 | |
| Critical | CVE-2026-58046 | WebPros Plesk: SQL Injection | 9.9 | |
| Critical | CVE-2026-67402 | WebPros ConfigServer Security & Firewall: Files or Directories Accessible to External Parties | — |
News
- Critical cPanel Flaw Could Let One Hosting Customer Take Root Control of a Whole Serverthehackernews,
- @RISK®: The Consensus Security Vulnerability Alert: Vol. 26, Num. 30sans-atrisk-mail,
- New cPanel Critical Flaw Could Let Hosting Customers Run SQL as Database Rootthehackernews,
- @RISK®: The Consensus Security Vulnerability Alert: Vol. 26, Num. 24sans-atrisk-mail,
- Fwd: @RISK®: The Consensus Security Vulnerability Alert: Vol. 26, Num. 20sans-atrisk,
- Fwd: @RISK®: The Consensus Security Vulnerability Alert: Vol. 26, Num. 19sans-atrisk,
Products
| WebPros cPanel | 18 | 1 |
| WebPros Plesk | 14 | 0 |
| Wp Squared | 14 | 1 |
| Cpanel (cloudlinux 6, Centos 6) | 5 | 0 |
| Configserver Security & Firewall | 3 | 0 |
| WebPros WHMCS | 3 | 0 |