CVE Tools
Track your stack

Webpros

34 CVEs tracked since 2026. Since May 2026, none of them reached CISA KEV.

Webpros CVEs per month

May 2026 to Oct 2026. Point at a month, or focus the strip and use the arrow keys.
Webpros CVEs per month, with the share now in CISA KEV
MonthCVEsIn CISA KEV
2026-05120
2026-067 or fewer
2026-077 or fewer
2026-088 or fewer
2026-09180
2026-1040

Products

The products that kept showing up in Webpros's monthly top three, with their CVEs summed over those months.

  1. Cpanel153 months
  2. Wp Squared112 months
  3. Cpanel (Cloudlinux 6, Centos 6)51 month
  4. Plesk51 month
  5. Configserver Security & Firewall31 month
  6. Wp Toolkit11 month

Latest CVEs

The 15 most recently published vulnerabilities affecting Webpros.

  1. CVE-2026-93699Argument injection in WP Toolkit for cPanel allows local users to execute arbitrary code as other accounts on the same server.—
  2. CVE-2026-93029There is a stored XSS vulnerability allowing arbitrary code execution in the WHM Manage SSL Hosts interface.9.0
  3. CVE-2026-93697There is a stored XSS vulnerability allowing arbitrary code execution in the WHM Mass Modify Accounts interface.9.0
  4. CVE-2026-93698Insufficient validation allows arbitrary commands to be executed via the Multilang adminbin.9.9
  5. CVE-2026-87900Argument injection in WP Toolkit for cPanel 6.11.2-10794 and earlier allows remote authenticated users to read arbitrary files and execute arbitrary code across customer accounts.—
  6. CVE-2026-87899Execution with unnecessary privileges in cPanel allows remote authenticated users to execute arbitrary code with root privileges.—
  7. CVE-2026-87898OS command injection in Plesk allows remote authenticated users to execute arbitrary code with root privileges.—
  8. CVE-2026-68492An untrusted search path vulnerability in Plesk from 18.0.34 before 18.0.80.8 and 18.0.81 before 18.0.81.1 allows remote authenticated users to execute arbitrary code as root via the "Plesk RESTful...—
  9. CVE-2026-68490Incorrect permission assignment allows local users to obtain sensitive CalDAV/CardDAV information belonging to other accounts.—
  10. CVE-2026-68491An insufficient check allowed for the overwrite of arbitrary files via a symlink.—
  11. CVE-2026-67399Deserialization of untrusted data in WHMCS 9.0.0 before 9.0.8 and 8.0.0 before 8.13.7 allows remote attackers to execute arbitrary code.—
  12. CVE-2026-68489Static Code Injection in Plesk extensions "Ruby" before 1.6.6 and "Node.js Toolkit" before 2.5.0 allows remote authenticated users to execute arbitrary code as root via custom environment variables.—
  13. CVE-2026-65639OS command injection in the advanced-rule parser of ConfigServer Security & Firewall allows a remote attacker who controls a configured allow/deny feed to execute arbitrary commands as root, due to...—
  14. CVE-2026-65638Improper escaping of a request URL in ConfigServer Security & Firewall allows an unauthenticated remote attacker to execute arbitrary commands as the CSF service account via shell command injectio...—
  15. CVE-2026-68488A Time-of-check Time-of-use (TOCTOU) race condition leading to insecure symlink following in Plesk causes local privilege escalation to root via arbitrary file/directory ownership takeover.9.9

The record

Peak rank
#93 in Sep 2026
Busiest month shown
Sep 2026, 18 CVEs
Months with a KEV entry
0 since May 2026
Monthly snapshots
3 since 2026
Webpros's full record, month by month