CVE-2026-44962: WebPros Plesk

Critical severity, CVSS 9.9. EPSS: 0.6% chance of exploitation in the next 30 days.

Plesk contains an XPath injection vulnerability in the APS Application Catalog search functionality, where user-supplied input is interpolated into XPath queries without proper sanitization. This allows an authenticated, low-privileged user to execute arbitrary operating system commands on the server, resulting in local privilege escalation.

Affected products

• WebPros Plesk: before 18.0.75.1 (fixed in 18.0.75.1); before 18.0.76.2 (fixed in 18.0.76.2)

Published 2026-05-29. Last modified 2026-08-14.