# WebPros vulnerabilities & exploitation > As of 2026-10-10, Threadlinqs tracks 10 WebPros CVEs, 0 in the CISA Known Exploited Vulnerabilities catalog, linked to 6 tracked threat campaigns. **Data as of:** 2026-10-10 ## Exploitation timeline Threadlinqs has recorded 10 WebPros CVEs published between 2026-05-15 and 2026-10-15. The busiest month was 2026-09 (4 new CVEs). None of them is listed in CISA KEV yet. ## Most exploited vulnerabilities Ranked with CISA KEV listings first, then EPSS exploit probability, then CVSS score. Showing 10 of 10 tracked WebPros CVEs. - [CVE-2026-65643](https://intel.threadlinqs.com/cve/CVE-2026-65643) — HIGH 8.7 · EPSS 0.9% · 2026-09-01 - [CVE-2026-93698](https://intel.threadlinqs.com/cve/CVE-2026-93698) — CRITICAL 9.9 · EPSS 0.6% · 2026-10-02 - [CVE-2026-87900](https://intel.threadlinqs.com/cve/CVE-2026-87900) — CRITICAL 9.4 · EPSS 0.6% · 2026-09-23 - [CVE-2026-87899](https://intel.threadlinqs.com/cve/CVE-2026-87899) — CRITICAL 9.4 · EPSS 0.6% · 2026-09-23 - [CVE-2026-44962](https://intel.threadlinqs.com/cve/CVE-2026-44962) — CRITICAL 9.9 · EPSS 0.6% · 2026-05-29 - [CVE-2026-93029](https://intel.threadlinqs.com/cve/CVE-2026-93029) — CRITICAL 9 · EPSS 0.5% · 2026-10-02 - [CVE-2026-93697](https://intel.threadlinqs.com/cve/CVE-2026-93697) — CRITICAL 9 · EPSS 0.5% · 2026-10-02 - [CVE-2026-58048](https://intel.threadlinqs.com/cve/CVE-2026-58048) — CRITICAL 9.4 · EPSS 0.5% · 2026-07-31 - [CVE-2026-29205](https://intel.threadlinqs.com/cve/CVE-2026-29205) — HIGH 8.6 · EPSS 0.4% · 2026-05-13 - [CVE-2026-68490](https://intel.threadlinqs.com/cve/CVE-2026-68490) — HIGH 8.2 · EPSS 0.1% · 2026-09-23 ## Products affected Threadlinqs normalises CPE and CNA product records across all 10 CVEs; 4 distinct WebPros products are affected. The most frequently affected: - cPanel — 8 CVEs - WP Squared — 5 CVEs - Plesk — 1 CVE - WP Toolkit for cPanel — 1 CVE ## Threat activity 6 tracked threat campaigns reference WebPros products or exploit WebPros CVEs: - [Multiple cPanel & WHM Vulnerabilities (CVE-2026-93698, CVE-2026-93029, CVE-2026-93697) Enable Root Code Execution and Admin Session Hijacking](https://intel.threadlinqs.com/threat/TL-2026-2912) — CRITICAL — 2026-10-04 - [cPanel/WHM CalDAV/CardDAV and WP Toolkit Flaws Enable Cross-Account Access and Root Privilege Escalation (CVE-2026-68490, CVE-2026-87899, CVE-2026-87900)](https://intel.threadlinqs.com/threat/TL-2026-2636) — CRITICAL — 2026-09-23 - [CVE-2026-65643: Arbitrary File Creation in cPanel/WHM Domain Parking Leads to Root-Level Code Execution](https://intel.threadlinqs.com/threat/TL-2026-2177) — CRITICAL — 2026-08-28 - [CVE-2026-58048 — cPanel & WHM Database Privilege Escalation via Database Rename (SQL Mode Loss)](https://intel.threadlinqs.com/threat/TL-2026-1862) — CRITICAL — 2026-08-04 - [Plesk Obsidian CVE-2026-44962 — Authenticated XPath Injection to OS Command Execution in APS Application Catalog (CVSS 9.9)](https://intel.threadlinqs.com/threat/TL-2026-0645) — CRITICAL — 2026-06-01 - [cPanel & WHM Missing Authentication for Critical Function (CVE-2026-41940) — CISA KEV](https://intel.threadlinqs.com/threat/TL-2026-0440) — CRITICAL — 2026-04-30 ## How to prioritise WebPros patching This order follows the data Threadlinqs holds for WebPros, not a generic severity checklist: - No WebPros CVE is in CISA KEV yet, so rank by exploit probability instead. - Outside KEV, the highest EPSS scores are [CVE-2026-65643](https://intel.threadlinqs.com/cve/CVE-2026-65643) (0.9%), [CVE-2026-93698](https://intel.threadlinqs.com/cve/CVE-2026-93698) (0.6%), [CVE-2026-87900](https://intel.threadlinqs.com/cve/CVE-2026-87900) (0.6%). - 7 CVEs score Critical and 3 High on CVSS v3 (maximum 9.9, average 9.2); sequence these after KEV and high-EPSS items. - 2 CVEs have a public exploit or proof of concept recorded, which shortens the time from disclosure to attack. ## About this data Vendor attribution comes from the CNA and CPE product records of each CVE, folded to one vendor name; CVSS, EPSS and KEV status are read from the Threadlinqs CVE catalog; campaign and actor links come from tracked threat records. Counts reflect the data as of 2026-10-10 and refresh daily. Canonical: https://intel.threadlinqs.com/vendors/webpros All vendors: https://intel.threadlinqs.com/vendors Full detection coverage and IOCs via the Threadlinqs MCP server (Purple tier): https://intel.threadlinqs.com/mcp