WebPros Plesk versions 18.0.75.1 and 18.0.76.2 contain an XPath injection vulnerability (CWE-643) in the APS Application Catalog search functionality. User-supplied input is directly interpolated into XPath expressions without proper neutralization, enabling an authenticated low-privileged user to execute arbitrary OS commands on the server. This results in local privilege escalation. The vulnerability has a CVSS 3.1 base score of 10.0, reflecting its critical impact and ease of exploitation. As of the published date, no official patch or remediation level has been provided by the vendor, and no exploits are known to be active in the wild.

Successful exploitation allows an authenticated low-privileged user to execute arbitrary operating system commands on the server, resulting in local privilege escalation. This compromises confidentiality, integrity, and availability of the affected system. Given the critical CVSS score of 10.0, the impact is severe.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict access to the APS Application Catalog search functionality to trusted users only and monitor for suspicious activity related to XPath queries. Avoid exposing the affected Plesk versions to untrusted networks or users. Follow vendor updates closely for any forthcoming patches or mitigations.