cPanel prior to 71.9980.37 allows stored XSS in the WHM cPAddons installation interface (SEC-398).
cpanel cpanel