CVE-2026-32993: WebPros cPanel

High severity, CVSS 8.3. EPSS: 0.4% chance of exploitation in the next 30 days.

Improper sanitization of the `status` query parameter of the `/unprotected/nova_error` endpoint allows unauthenticated attacker to inject arbitrary HTTP header to the response.

Affected products

• WebPros cPanel: from 11.132.0.0, before 11.132.0.32 (fixed in 11.132.0.32); from 11.134.0.0, before 11.134.0.26 (fixed in 11.134.0.26); from 11.136.0.0, before 11.136.0.10 (fixed in 11.136.0.10)
• WebPros Wp Squared: from 11.132.1.0, before 11.136.1.12 (fixed in 11.136.1.12)

Published 2026-05-13. Last modified 2026-06-17.