This vulnerability is a stored cross-site scripting (CWE-79) flaw in the Webpros cPanel product, specifically within the WHM Mass Modify Accounts interface. It enables an attacker with low privileges to inject malicious scripts that are stored and executed in the context of other users, potentially leading to arbitrary code execution. The vulnerability affects multiple versions of cPanel prior to 11.138.0.11, 11.136.0.45, 11.134.0.61, 11.110.0.148, and 11.138.1.13. The CVSS v3 base score is 9.0, reflecting network attack vector, low attack complexity, required privileges, user interaction, and high impact on confidentiality, integrity, and availability. No vendor patch links are provided in the input data, and no known exploits have been reported in the wild.

Successful exploitation can lead to arbitrary code execution in the context of the affected web application, compromising confidentiality, integrity, and availability of the system. The vulnerability allows attackers to execute malicious scripts stored in the WHM Mass Modify Accounts interface, potentially affecting administrative users and system operations.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no official patch links are provided, users should monitor Webpros cPanel advisories for updates addressing this vulnerability. Until a fix is available, restrict access to the WHM Mass Modify Accounts interface to trusted users only and consider additional input validation or filtering as a temporary mitigation.