Login Request a demo
WH
Product
WHMCS
by WebPros · last CVE Sep 14, 2026
3
CVEs
0
On KEV
9.3
Max CVSS
0
New 30D
Vulnerabilities3In the news0Timeline
Severity mix
Critical 2High 1Medium 0Low 0
Severity
All severities3Critical2High1Medium0Low0
Exploitation
On CISA KEV0Exploited in the wild0
Watch

Add WHMCS to your stack to get only the CVEs that touch what you run.

CVECVSSEPSSPublishedSummary · affected versions
CVE-2026-67399
9.3
1%
Sep 14
Deserialization of untrusted data in WHMCS 9.0.0 before 9.0.8 and 8.0.0 before 8.13.7 allows remote attackers to execute arbitrary code
Affected: 9.0.0 before 9.0.8; 8.0.0 before 8.13.7
CVE-2026-29204
9.1
0%
May 12
Insufficient ownership check in `clientarea.php` allows an authenticated client area user to submit requests using another user’s `addonId` without any ownership validation…
Affected: 7.4.0 through 18.12.2; 18.13.0 before 18.13.3; 9.0.0 before 9.0.4
CVE-2026-67398
8.2
0%
Sep 3
Missing authorization vulnerability has been discovered in 2Checkout payment gateway of WHMCS from 8.13.0 before 8.13.7, from 9.0.0 before 9.0.8, all other EOL versions from 4.5.0
Affected: 4.5.0 before 8.12.2; 8.13.0 before 8.13.7; 9.0.0 before 9.0.8
Showing 3