# CVE-2026-39428: CubeCart stored XSS in product management fields

Source: https://junglewise.ai/threats/cve-2026-39428-cubecart-stored-xss-in-product-management-fields  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-05-13. Updated: 2026-05-14  
License: CC BY 4.0 with a link back

CVE-2026-39428 · Severity: medium · CVSS 4.8 · Published 2026-05-13

CubeCart is an e-commerce platform used to build and manage online stores. A security vulnerability in versions prior to 6.6.0 allows an administrative user to plant malicious scripts within product pages. When customers or other staff members view these products, the scripts could execute, potentially leading to the theft of login sessions or unauthorized actions on the site.

Technologies: [CubeCart](https://junglewise.ai/threats/technologies/cubecart). Vendors: [CubeCart](https://junglewise.ai/threats/vendors/cubecart).

## Quick answers

**Is CVE-2026-39428 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-39428 being exploited in the wild.

**How severe is CVE-2026-39428?** Medium severity, with a CVSS score of 4.8, published 13 May 2026.

**Which products and versions are affected?** CubeCart Prior to 6.6.0.

**Is there a fix for CVE-2026-39428?** A patch was published on 2026-05-13: Fix released in version 6.6.0 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-39428 attacked?** It is attacked over the network, in a web application.

**Am I affected by CVE-2026-39428?** Check whether you run CubeCart at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

A stored Cross-Site Scripting (XSS) vulnerability exists in CubeCart v6.x due to insufficient input sanitization and output encoding in the administrative product management interface. An attacker with high privileges (admin) can inject malicious JavaScript into the Product Name, Description, and Specification fields. These payloads are stored in the database and subsequently executed in the context of any user's browser (including customers and other administrators) who visits the affected product page. This can lead to session cookie theft or unauthorized redirection. The issue is resolved in version 6.6.0.

## Affected products

- CubeCart CubeCart v6.x Prior to 6.6.0

## Timeline

- 2026-05-12: advisory: GitHub Security Advisory published
- 2026-05-13: disclosed: NVD publication date
- 2026-05-13: patched: Fix released in version 6.6.0

## References

- [https://github.com/cubecart/v6/security/advisories/GHSA-gvxc-5v7r-272m](https://github.com/cubecart/v6/security/advisories/GHSA-gvxc-5v7r-272m)

## Related threats

- [CubeCart broken access control in GDPR customer purge](https://junglewise.ai/threats/cve-2026-54648-cubecart-broken-access-control-in-gdpr-customer-purge)
- [CubeCart SQL injection in download_expire settings parameter](https://junglewise.ai/threats/cve-2026-54647-cubecart-sql-injection-in-download-expire-settings-parameter)
- [CubeCart SQL identifier injection in maintenance tools](https://junglewise.ai/threats/cve-2026-54646-cubecart-sql-identifier-injection-in-maintenance-tools)
- [CubeCart stored XSS in product description fields](https://junglewise.ai/threats/cve-2026-54645-cubecart-stored-xss-in-product-description-fields)
- [CubeCart XSS in GUI messages via unsafe anchor attributes](https://junglewise.ai/threats/cve-2026-54644-cubecart-xss-in-gui-messages-via-unsafe-anchor-attributes)