WebPros
Vulnerability activity for WebPros: what is being exploited, what was published lately, and when the next patch release is due.
Last 30 days
- CVEs
- 0
- Critical (CVSS 9+)
- 0
- Exploited (CISA KEV)
- 0
- With exploit code
- 0
Last 90 days
- CVEs
- 2
- Critical (CVSS 9+)
- 1
- Exploited (CISA KEV)
- 0
- With exploit code
- 0
Last 365 days
- CVEs
- 7
- Critical (CVSS 9+)
- 5
- Exploited (CISA KEV)
- 1
- With exploit code
- 1
Exploited now
CVEs on CISA's known-exploited list, newest first. "Days to KEV" counts from the CVE's publication.
Recent
- 9.9CriticalAug 7, 2026WebPros Plesk Privilege escalationCVE-2026-64637Improper privilege management in the XML-RPC API of Plesk before 18.0.80, allows an authenticated reseller to obtain an administrative session for the root user account.
- 7.7HighAug 7, 2026WebPros Plesk SQL injectionCVE-2026-64636An SQL injection vulnerability in Plesk Obsidian up to 18.0.80 for Linux and Windows allows an authenticated user to read arbitrary data from the panel database.
- 9.9CriticalJul 6, 2026WebPros Plesk Code / command injectionCVE-2026-48614An improper authorization vulnerability in the Plesk XML API allows an authenticated user to inject arbitrary configuration directives, resulting in arbitrary file write as root and full privilege escalation on the underlying server.
- 9.0CriticalMay 28, 2026WebPros Comet Backup Code / command injectionCVE-2026-32999Insufficient character filtering in backup agent signing module on Comet Backup server allows authenticated tenant administrator to execute an arbitrary code on behalf of a privileged user on the affected server and connected devices.
- 8.8HighMay 8, 2026WebPros cPanel Path traversal / file handlingCVE-2026-29203A chmod call in the cPanel Nova plugin's Cpanel::Nova::Connector follows symlinks, allowing setting root permissions on arbitrary system files or directories. That can cause DoS or local privilege escalation when an authenticated cPanel user places a symlink at a user-controlled legacy Nova path under their home directory.
- 9.9CriticalMay 4, 2026WebPros Comet Backup Auth bypass / access controlCVE-2026-29200A critical IDOR vulnerability has been discovered in Comet Backup affecting all versions from 20.11.0 to 26.1.1 and 26.2.1. The vulnerability allows a tenant administrator to impersonate any end-user account of other tenants on the same server via a vulnerable API call.
- 9.8CriticalApr 30, 2026WebPros cPanel & WHM and WP2 (WordPress Squared) Auth bypass / access controlCVE-2026-41940WebPros cPanel & WHM (WebHost Manager) and WP2 (WordPress Squared) contain an authentication bypass vulnerability in the login flow that allows unauthenticated remote attackers to gain unauthorized access to the control panel.Exploited99% likelyExploit codeExploit-DB · Metasploit · NucleiDetection
Top products
- Plesk3 CVEs in the last year, 2 critical
- Comet Backup2 CVEs in the last year, 2 critical
- cPanel & WHM and WP2 (WordPress Squared)1 CVE in the last year, 1 critical, 1 exploited
- cPanel1 CVE in the last year
Counts cover CVEs and advisories Watch Floor tracks, by the date they became news. Updated every 10 minutes.