CVE-2026-87898: WebPros Plesk Extension Site Import

Critical severity, CVSS 9.4. EPSS: 1% chance of exploitation in the next 30 days.

OS command injection in Plesk allows remote authenticated users to execute arbitrary code with root privileges.

Affected products

• WebPros Plesk Extension Site Import: from 1.6.6, up to and including 1.12.1

Published 2026-09-23. Last modified 2026-09-24.