WebPros vulnerabilities & exploitation

Exploitation timeline

Threadlinqs has recorded 10 WebPros CVEs published between 2026-05-15 and 2026-10-15. The busiest month was 2026-09 (4 new CVEs). None of them is listed in CISA KEV yet.

Most exploited vulnerabilities

Ranked with CISA KEV listings first, then EPSS exploit probability, then CVSS score. Showing 10 of 10 tracked WebPros CVEs.

• CVE-2026-65643high 8.7EPSS 0.9%2026-09-01
• CVE-2026-93698critical 9.9EPSS 0.6%2026-10-02
• CVE-2026-87900critical 9.4EPSS 0.6%2026-09-23
• CVE-2026-87899critical 9.4EPSS 0.6%2026-09-23
• CVE-2026-44962critical 9.9EPSS 0.6%2026-05-29
• CVE-2026-93029critical 9EPSS 0.5%2026-10-02
• CVE-2026-93697critical 9EPSS 0.5%2026-10-02
• CVE-2026-58048critical 9.4EPSS 0.5%2026-07-31
• CVE-2026-29205high 8.6EPSS 0.4%2026-05-13
• CVE-2026-68490high 8.2EPSS 0.1%2026-09-23

Products affected

Threadlinqs normalises CPE and CNA product records across all 10 CVEs; 4 distinct WebPros products are affected. The most frequently affected:

• cPanel 8 CVEs
• WP Squared 5 CVEs
• Plesk 1 CVE
• WP Toolkit for cPanel 1 CVE

Threat activity

6 tracked threat campaigns reference WebPros products or exploit WebPros CVEs:

• Multiple cPanel & WHM Vulnerabilities (CVE-2026-93698, CVE-2026-93029, CVE-2026-93697) Enable Root Code Execution and Admin Session HijackingCRITICAL2026-10-04
• cPanel/WHM CalDAV/CardDAV and WP Toolkit Flaws Enable Cross-Account Access and Root Privilege Escalation (CVE-2026-68490, CVE-2026-87899, CVE-2026-87900)CRITICAL2026-09-23
• CVE-2026-65643: Arbitrary File Creation in cPanel/WHM Domain Parking Leads to Root-Level Code ExecutionCRITICAL2026-08-28
• CVE-2026-58048 — cPanel & WHM Database Privilege Escalation via Database Rename (SQL Mode Loss)CRITICAL2026-08-04
• Plesk Obsidian CVE-2026-44962 — Authenticated XPath Injection to OS Command Execution in APS Application Catalog (CVSS 9.9)CRITICAL2026-06-01
• cPanel & WHM Missing Authentication for Critical Function (CVE-2026-41940) — CISA KEVCRITICAL2026-04-30

How to prioritise WebPros patching

This order follows the data Threadlinqs holds for WebPros, not a generic severity checklist:

• No WebPros CVE is in CISA KEV yet, so rank by exploit probability instead.
• Outside KEV, the highest EPSS scores are CVE-2026-65643 (0.9%), CVE-2026-93698 (0.6%), CVE-2026-87900 (0.6%).
• 7 CVEs score Critical and 3 High on CVSS v3 (maximum 9.9, average 9.2); sequence these after KEV and high-EPSS items.
• 2 CVEs have a public exploit or proof of concept recorded, which shortens the time from disclosure to attack.

About this data

Vendor attribution comes from the CNA and CPE product records of each CVE, folded to one vendor name; CVSS, EPSS and KEV status are read from the Threadlinqs CVE catalog; campaign and actor links come from tracked threat records. Counts reflect the data as of 2026-10-10 and refresh daily.