cPanel prior to 60.0.25 allows stored XSS during the homedir removal phase of WHM Account termination (SEC-174).
cpanel cpanel