Stored XSS in WHM SSL Host Management Interface

There is a stored XSS vulnerability allowing arbitrary code execution in the WHM Manage SSL Hosts interface.

Casky was already ahead

This CVE exploits attack patterns that Casky's 323matched skills already investigate — long before this vulnerability was disclosed. Claude's reasoning model maps these techniques to MITRE ATT&CK, so practitioners who ran these skills have already seen the threat behaviour in their findings.

Analysis

CVE-2026-93029 is a critical stored cross-site scripting (XSS) vulnerability in cPanel's WebHost Manager (WHM) Manage SSL Hosts interface. With a CVSS score of 9, this vulnerability allows attackers to inject and persist arbitrary malicious code that executes in the browsers of administrative users. WHM administrators managing SSL certificates are the primary targets, making this particularly dangerous since these users typically have elevated privileges to modify server configurations, install certificates, and access sensitive infrastructure data. The stored nature of this XSS means the payload persists in the application's database, affecting every administrator who accesses the vulnerable interface until patching occurs.

Casky.ai's 323 mapped security skills leverage Claude's extended reasoning to detect the attack patterns underlying this vulnerability across two critical MITRE ATT&CK techniques: TA0001 (Initial Access) and TA0043 (Reconnaissance). Practitioners using the platform would observe detection patterns for CWE-79 violations including malicious input validation bypasses in SSL host configuration fields, suspicious JavaScript injection attempts in certificate metadata, and anomalous DOM manipulation in the WHM interface. The skills enable detection of both the exploitation phase—where attackers craft payloads targeting input sanitization gaps—and the impact phase where stored malicious scripts execute during administrative sessions, potentially leading to credential theft, lateral movement, or infrastructure compromise. Security teams gain visibility into how threat actors abuse administrative interfaces to establish persistent code execution footholds within trusted management consoles.

Live Threat IntelligenceComing soon

Casky Risk Score

—

EPSS Probability

—

Shodan Exposure

—

GreyNoise Signal

—

Composite risk scoring from EPSS, CISA KEV, Shodan, and GreyNoise — 21 security APIs correlated into a single Casky Risk Score. Coming in Casky Pro. Join early access →

323 Casky skills cover this attack pattern

These skills use Claude AI's reasoning model to surface findings in the same attack categories as CVE-2026-93029.

Abuse of Public-Facing API: Mobile API Abuse

mobile security · low

Run

abusing-dpapi-for-credential-access

red teaming · high

Run

abusing-shadow-credentials-for-privesc

red teaming · high

Run

MITRE ATT&CK Techniques

TA0001 TA0043

Investigate the attack patterns behind CVE-2026-93029

Casky has 323 skills that investigate the attack patterns behind CVE-2026-93029. Run one and get CVSS-scored findings in 3 minutes.

Run the skill that detects this →

X Instagram LinkedIn