Security Advisory: WHMCS Stored XSS

This is a security release for WHMCS. Update the product on every affected server to the patched release — there is no workaround, and unpatched servers remain exposed until updated.

Medium 2026-08-06

WHMCS

Affected Versions

8.7.0 and earlier

Patched Version

8.7.1

Default Update CMD

yum update -y

Fix Commands

Any supported OS

cd /var/www/html
php composer.phar update whmcs/core

What this means under a SharedLicense license

Your SharedLicense license itself is not affected — this is a change in WHMCS software, not in licensing. Apply it on every affected server: update to the fixed release from the WHMCS Admin Area. Licenses keep working through updates; nothing needs re-issuing or re-activating.

A stored cross-site scripting (XSS) vulnerability was found in the WHMCS admin panel, allowing an authenticated user to inject malicious scripts.

References

Vendor Advisory

Security Advisories

Related Advisories

WHMCS 9.1.0 Security Update

2026-10-01

WHMCS CVE-2026-16272

2026-09-09 00:00:00

PayTR Module for WHMCS CVE-2026-16025: Input Data Manipulation

2026-09-08 00:00:00

Check your system for vulnerabilities

Select your product and operating system to see the exact fix commands that apply to you.

Check Your System