Wp Squared (Cpanel) - vulnerabilities (CVEs)

3 CVEs, 0 in the last 30 days, 59 known versions, newest CVE from 2026-05-13. Vendor: Cpanel.

CVEs of Wp Squared

• CVE-2026-32992 - CVSS 8.2 (high), 2026-05-13: SSL verification is disabled in the DNS Cluster system. This could allow for a malicious server to man-in-the-middle the request and capture credentials.
• CVE-2026-29205 - CVSS 8.6 (high), 2026-05-13: Incorrect privileges management and insufficient path filtering allow to read arbitrary file on the server via the cpdavd attachment download endpoints.
• CVE-2026-41940 - CVSS 9.8 (critical), 2026-04-29: cPanel and WHM versions after 11.40 contain an authentication bypass vulnerability in the login flow that allows unauthenticated remote attackers to gain…