cPanel prior to 62.0.24 allows stored XSS in the WHM cPAddons install interface (SEC-262).
cpanel cpanel