# CVE-2026-54644: CubeCart XSS in GUI messages via unsafe anchor attributes

Source: https://junglewise.ai/threats/cve-2026-54644-cubecart-xss-in-gui-messages-via-unsafe-anchor-attributes  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-09-17. Updated: 2026-09-26  
License: CC BY 4.0 with a link back

CVE-2026-54644 · Severity: medium · CVSS 6.1 · Published 2026-09-17

CubeCart is an e-commerce platform used to run online stores. The system's error and warning messages were not properly filtering malicious content in links, allowing attackers to inject JavaScript code that executes when administrators view those messages. This could lead to session hijacking, unauthorized store actions, or data theft within an admin's browser session.

Technologies: [CubeCart](https://junglewise.ai/threats/technologies/cubecart). Vendors: [CubeCart](https://junglewise.ai/threats/vendors/cubecart).

## Quick answers

**Is CVE-2026-54644 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-54644 being exploited in the wild.

**How severe is CVE-2026-54644?** Medium severity, with a CVSS score of 6.1, published 17 September 2026.

**Which products and versions are affected?** CubeCart prior to 6.7.5.

**Is there a fix for CVE-2026-54644?** A patch was published on 2026-09-17: Fixed in version 6.7.5 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-54644 attacked?** It is attacked over the network.

**Am I affected by CVE-2026-54644?** Check whether you run CubeCart at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

The vulnerability is a stored cross-site scripting (XSS) flaw in the _errorMessage method of classes/gui.class.php. The code uses strip_tags() to permit anchor elements in error, information, and warning messages, but this approach preserves unsafe href attributes (including javascript: URIs) and onclick event handlers. Attacker-controlled input from search parameters or form fields can reach GUI messages and pass through the filter. When an authenticated administrator views the rendered anchor and clicks it or the page loads, the injected JavaScript executes in their browser session with full administrative privileges. The vulnerability requires an attacker to inject malicious data into searchable or logged fields that are later displayed in system messages. The fix, released in version 6.7.5, rebuilds anchor elements with only a scheme-validated href attribute, stripping all other unsafe attributes.

## Affected products

- CubeCart CubeCart prior to 6.7.5

## Timeline

- 2026-09-17: disclosed
- 2026-09-17: patched: Fixed in version 6.7.5

## References

- [https://github.com/cubecart/v6/blob/6.7.5/admin/sources/release_notes/6.7.5.inc.php](https://github.com/cubecart/v6/blob/6.7.5/admin/sources/release_notes/6.7.5.inc.php)
- [https://github.com/cubecart/v6/commit/7c4c0081fd346578a95738f480ef647116ee1c82](https://github.com/cubecart/v6/commit/7c4c0081fd346578a95738f480ef647116ee1c82)

## Related threats

- [CubeCart broken access control in GDPR customer purge](https://junglewise.ai/threats/cve-2026-54648-cubecart-broken-access-control-in-gdpr-customer-purge)
- [CubeCart SQL injection in download_expire settings parameter](https://junglewise.ai/threats/cve-2026-54647-cubecart-sql-injection-in-download-expire-settings-parameter)
- [CubeCart SQL identifier injection in maintenance tools](https://junglewise.ai/threats/cve-2026-54646-cubecart-sql-identifier-injection-in-maintenance-tools)
- [CubeCart stored XSS in product description fields](https://junglewise.ai/threats/cve-2026-54645-cubecart-stored-xss-in-product-description-fields)
- [CubeCart missing delete permission check in order notes handler](https://junglewise.ai/threats/cve-2026-54643-cubecart-missing-delete-permission-check-in-order-notes-handler)