Login Request a demo
WE
Vendor
Webpros
21 products with CVEs on record
73
CVEs
4
On KEV
8
New 30D
Products
CP
cPanel
Webpros
9.9
18 CVEs1 on KEV3 new
WS
WP Squared
Webpros
9.9
14 CVEs1 on KEV3 new
S2
SolusVM 2
WebPros
9.4
1 CVEs0 on KEV1 new
WT
WP Toolkit
WebPros
8.5
1 CVEs0 on KEV1 new
CW
cPanel & WHM and WP2 (WordPress Squared)
WebPros
9.8
1 CVEs1 on KEV0 new
WH
WHM
WebPros
9.8
1 CVEs1 on KEV0 new
PL
Plesk
Webpros
9.9
14 CVEs0 on KEV0 new
CC
cPanel (CloudLinux 6, CentOS 6)
WebPros
8.8
5 CVEs0 on KEV0 new
CS
ConfigServer Security & Firewall
WebPros
9.5
3 CVEs0 on KEV0 new
WH
WHMCS
WebPros
9.3
3 CVEs0 on KEV0 new
CB
Comet Backup
WebPros
9.9
2 CVEs0 on KEV0 new
PE
Plesk extension "Node.js Toolkit"
WebPros
8.7
1 CVEs0 on KEV0 new
PE
Plesk extension "Plesk RESTful API"
WebPros
8.7
1 CVEs0 on KEV0 new
PE
Plesk extension "Ruby"
WebPros
8.7
1 CVEs0 on KEV0 new
PE
Plesk extension "Site Import"
WebPros
9.4
1 CVEs0 on KEV0 new
PM
Plesk Migrator
WebPros
8.7
1 CVEs0 on KEV0 new
PO
Plesk Obsidian
Webpros
7.5
1 CVEs0 on KEV0 new
PS
Plesk Site Import
WebPros
8.7
1 CVEs0 on KEV0 new
SO
SolusVM
Webpros
9.4
1 CVEs0 on KEV0 new
WO
WordPress-Toolkit
WebPros
9.9
1 CVEs0 on KEV0 new
WT
WP Toolkit for cPanel
WebPros
9.4
1 CVEs0 on KEV0 new
Recent CVEs
CVEProductCVSSEPSSPublishedSummary
CVE-2026-105474
S2
SolusVM 2
WebPros
9.4
0%
Oct 15A server-side template injection exists in SolusVM 2 up to version 2.0.0-44576 that allows remote authenticated users to execute arbitrary code as root
CVE-2026-93699
WT
WP Toolkit
WebPros
8.5
0%
Oct 8Argument injection in WP Toolkit for cPanel allows local users to execute arbitrary code as other accounts on the same server
CVE-2026-93029
CP
cPanel
Webpros
9.0
1%
Oct 2There is a stored XSS vulnerability allowing arbitrary code execution in the WHM Manage SSL Hosts interface
CVE-2026-93697
WS
WP Squared
Webpros
9.0
1%
Oct 2There is a stored XSS vulnerability allowing arbitrary code execution in the WHM Mass Modify Accounts interface
CVE-2026-93698
CP
cPanel
Webpros
9.9
1%
Oct 2Insufficient validation allows arbitrary commands to be executed via the Multilang adminbin
CVE-2026-87899
CP
cPanel
WebPros
9.4
1%
Sep 23Execution with unnecessary privileges in cPanel allows remote authenticated users to execute arbitrary code with root privileges
CVE-2026-68492
PL
Plesk
WebPros
8.7
1%
Sep 23An untrusted search path vulnerability in Plesk from 18.0.34 before 18.0.80.8 and 18.0.81 before 18.0.81.1 allows remote authenticated users to execute arbitrary code as root via…
CVE-2026-68490
CP
cPanel
WebPros
8.2
0%
Sep 23Incorrect permission assignment allows local users to obtain sensitive CalDAV/CardDAV information belonging to other accounts
CVE-2026-87900
WT
WP Toolkit for cPanel
WebPros
9.4
1%
Sep 23Argument injection in WP Toolkit for cPanel 6.11.2-10794 and earlier allows remote authenticated users to read arbitrary files and execute arbitrary code across customer accounts
CVE-2026-87898
PE
Plesk extension "Site Import"
WebPros
9.4
1%
Sep 23OS command injection in Plesk allows remote authenticated users to execute arbitrary code with root privileges
CVE-2026-68491
SO
SolusVM
Webpros
9.4
0%
Sep 15An insufficient check allowed for the overwrite of arbitrary files via a symlink
CVE-2026-68489
PE
Plesk extension "Node.js Toolkit"
WebPros
8.7
1%
Sep 14Static Code Injection in Plesk extensions "Ruby" before 1.6.6 and "Node.js Toolkit" before 2.5.0 allows remote authenticated users to execute arbitrary code as root via custom…
CVE-2026-67399
WH
WHMCS
WebPros
9.3
1%
Sep 14Deserialization of untrusted data in WHMCS 9.0.0 before 9.0.8 and 8.0.0 before 8.13.7 allows remote attackers to execute arbitrary code
CVE-2026-65639
CS
ConfigServer Security & Firewall
WebPros
9.5
1%
Sep 10OS command injection in the advanced-rule parser of ConfigServer Security & Firewall allows a remote attacker who controls a configured allow/deny feed to execute arbitrary…
CVE-2026-68487
PL
Plesk
WebPros
9.9
1%
Sep 10Path traversal in Plesk's Backup Manager causes arbitrary file write as root by an authenticated customer
CVE-2026-65638
CS
ConfigServer Security & Firewall
WebPros
9.2
2%
Sep 10Improper escaping of a request URL in ConfigServer Security & Firewall allows an unauthenticated remote attacker to execute arbitrary commands as the CSF service account via…
CVE-2026-68488
PL
Plesk
WebPros
9.9
0%
Sep 10A Time-of-check Time-of-use (TOCTOU) race condition leading to insecure symlink following in Plesk causes local privilege escalation to root via arbitrary file/directory ownership…
CVE-2026-67401
CP
cPanel
WebPros
9.9
1%
Sep 9A vulnerability in cPanel allows a mail-enabled account to achieve remote code execution as root through SQLi in EmailTrack component
CVE-2026-67397
PL
Plesk
WebPros
8.5
0%
Sep 3Path traversal in Plesk 18.0.79.9 and earlier and 18.0.80 through 18.0.80.5 allows local users to execute arbitrary code as root
CVE-2026-67402
CS
ConfigServer Security & Firewall
WebPros
9.2
1%
Sep 3An insecure Apache configuration in ConfigServer Security & Firewall maps /usr/bin as CGI programs through the Messenger v3 HTTPS virtual host
CVE-2026-67398
WH
WHMCS
WebPros
8.2
0%
Sep 3Missing authorization vulnerability has been discovered in 2Checkout payment gateway of WHMCS from 8.13.0 before 8.13.7, from 9.0.0 before 9.0.8, all other EOL versions from 4.5.0
CVE-2026-65643
CP
cPanel
WebPros
8.8
1%
Sep 1Eval injection in cPanel 11.138.0.0 and earlier allows remote authenticated users to execute arbitrary code as root
CVE-2026-67394
PL
Plesk
WebPros
9.0
1%
Sep 1A critical local privilege escalation via OS command injection vulnerability has been discovered in Plesk for Linux, affecting all versions from 18.0.34 before 18.0.79.9 and…
CVE-2026-65646
PL
Plesk
WebPros
9.9
1%
Aug 26Improper neutralization of special elements in in Plesk's DNS zone management functionality allows remote authenticated users to disclose arbitrary local files and escalate…
CVE-2026-65642
PL
Plesk
WebPros
8.6
0%
Aug 26Insecure direct object reference in Plesk 18.0.79.7 and earlier or 18.0.80 through 18.0.80.3, allows remote authenticated users to read and modify other customers' databases
CVE-2026-65647
PS
Plesk Site Import
WebPros
8.7
1%
Aug 26Improper symlink resolution before file access in Plesk allows remote authenticated users to execute arbitrary code as root
CVE-2026-64639
PL
Plesk
WebPros
9.3
1%
Aug 12Incorrect database cloning process in Plesk from 18.0.52 before 18.0.79.6 and 18.0.80.2 allows a low-privileged user (customer, reseller) to execute arbitrary code on behalf of…
CVE-2026-64637
PL
Plesk
WebPros
9.9
0%
Aug 7Improper privilege management in the XML-RPC API of Plesk before 18.0.80, allows an authenticated reseller to obtain an administrative session for the root user account
CVE-2026-64636
PL
Plesk
WebPros
7.7
0%
Aug 7An SQL injection vulnerability in Plesk Obsidian up to 18.0.80 for Linux and Windows allows an authenticated user to read arbitrary data from the panel database
CVE-2026-58048
CP
cPanel
WebPros
9.4
1%
Jul 31Improper preservation of SQL mode when renaming databases in cPanel allows execution of SQL in root context
CVE-2026-58047
WS
WP Squared
WebPros
5.6
1%
Jul 31HTTP Smuggling in cPanel allows potential leak of credentials
CVE-2026-58046
PL
Plesk
WebPros
9.9
1%
Jul 30Improper neutralization in the Plesk XML-RPC API allows a remote authenticated low-privileged user to perform SQL injection and read arbitrary data from the Plesk database,…
CVE-2026-56843
PL
Plesk
Webpros
9.9
1%
Jul 8Incorrect authorization in the XML-RPC API of WebPros Plesk before 18.0.78.4 allows a low-privileged authenticated customer to look up domains they do not own, because ownership…
CVE-2026-48614
PL
Plesk
WebPros
9.9
1%
Jul 6An improper authorization vulnerability in the Plesk XML API allows an authenticated user to inject arbitrary configuration directives, resulting in arbitrary file write as root…
CVE-2026-47365
WO
WordPress-Toolkit
WebPros
9.9
0%
Jun 12Argument injection vulnerability in WordPress Toolkit before 6.11.0 as used in cPanel & WHM, allows remote authenticated users to bypass cross-tenant authorization and execute…
CVE-2026-44962
PL
Plesk
WebPros
9.9
1%
May 29Plesk contains an XPath injection vulnerability in the APS Application Catalog search functionality, where user-supplied input is interpolated into XPath queries without proper…
CVE-2026-32999
CB
Comet Backup
WebPros
9.0
0%
May 28Insufficient character filtering in backup agent signing module on Comet Backup server allows authenticated tenant administrator to execute an arbitrary code on behalf of a…
CVE-2026-29206
WS
WP Squared
WebPros
8.1
0%
May 13Insufficient sanitization of SQL queries in the `sqloptimizer` utility script allows SQL Injections on behalf of the root user if Slow Query logging is enabled
CVE-2026-32991
CP
cPanel
WebPros
7.1
0%
May 13Improper authorization checks of team members privileges allow a team member to escalate privileges to the team owner account
CVE-2026-29205
WS
WP Squared
WebPros
8.6
8%
May 13Incorrect privileges management and insufficient path filtering allow to read arbitrary file on the server via the cpdavd attachment download endpoints
CVE-2026-32992
WS
WP Squared
WebPros
8.2
0%
May 13SSL verification is disabled in the DNS Cluster system
CVE-2026-32993
CP
cPanel
WebPros
8.3
0%
May 13Improper sanitization of the `status` query parameter of the `/unprotected/nova_error` endpoint allows unauthenticated attacker to inject arbitrary HTTP header to the response
CVE-2026-29204
WH
WHMCS
WebPros
9.1
0%
May 12Insufficient ownership check in `clientarea.php` allows an authenticated client area user to submit requests using another user’s `addonId` without any ownership validation…
CVE-2026-29201
CP
cPanel
WebPros
8.6
0%
May 8Insufficient input validation of the feature file name in `feature::LOADFEATUREFILE` adminbin call can cause arbitrary file read when a relative file path is passed
CVE-2026-29202
WS
WP Squared
WebPros
8.8
2%
May 8Insufficient input validation of the `plugin` parameter of the `create_user` plugin allows arbitrary Perl code execution on behalf of the already authenticated account's system…
CVE-2026-29203
CC
cPanel (CloudLinux 6, CentOS 6)
WebPros
8.8
0%
May 8A chmod call in the cPanel Nova plugin's Cpanel::Nova::Connector follows symlinks, allowing setting root permissions on arbitrary system files or directories
CVE-2026-29200
CB
Comet Backup
WebPros
9.9
0%
May 4A critical IDOR vulnerability has been discovered in Comet Backup affecting all versions from 20.11.0 to 26.1.1 and 26.2.1
CVE-2026-41940
RansomwareIn wildKEV
CP
cPanel
WebPros
9.8
99%
Apr 29WebPros cPanel and WHM Authentication Bypass via Login Flow
CVE-2025-65518
PO
Plesk Obsidian
Webpros
7.5
1%
Jan 8Plesk Obsidian versions 8.0.1 through 18.0.73 are vulnerable to a Denial of Service (DoS) condition