Executive brief
CubeCart is an e-commerce platform used to build and manage online stores. A security vulnerability in versions prior to 6.6.0 allows an administrative user to plant malicious scripts within product pages. When customers or other staff members view these products, the scripts could execute, potentially leading to the theft of login sessions or unauthorized actions on the site.
Technical details
A stored Cross-Site Scripting (XSS) vulnerability exists in CubeCart v6.x due to insufficient input sanitization and output encoding in the administrative product management interface. An attacker with high privileges (admin) can inject malicious JavaScript into the Product Name, Description, and Specification fields. These payloads are stored in the database and subsequently executed in the context of any user's browser (including customers and other administrators) who visits the affected product page. This can lead to session cookie theft or unauthorized redirection. The issue is resolved in version 6.6.0.
Affected products
- CubeCart CubeCart v6.x Prior to 6.6.0
Timeline
- 2026-05-12: advisory: GitHub Security Advisory published
- 2026-05-13: disclosed: NVD publication date
- 2026-05-13: patched: Fix released in version 6.6.0