CVE-2026-54645

Overview

CubeCart e-commerce platform versions prior to 6.7.5 allow persistent XSS via product description fields. Admins can inject malicious JavaScript that executes when visitors view product pages, potentially exposing sessions or performing unauthorized actions. The flaw is mitigated in version 6.7.5.

Description

CubeCart is an ecommerce software solution. Prior to 6.7.5, admin/sources/products.index.inc.php reads the description, description_short, and spec_copy rich-text fields from $GLOBALS['RAW']['POST'] and removes only script elements before the values are stored and rendered through Smarty templates. An administrator with product-editing rights can store event-handler attributes, SVG content, or javascript: URIs that bypass this filter, causing persistent JavaScript execution when a storefront visitor or another administrator views the product content and enabling session exposure or unauthorized browser-context actions. This issue is fixed in version 6.7.5.

Impact

Confidentiality: attackers can steal session cookies of site visitors or other admins. Integrity: malicious scripts can modify displayed content or redirect users. Availability: not directly impacted. Defenders: site admins and developers must patch or sanitize inputs.

Remediation

Upgrade to CubeCart 6.7.5 or later. If upgrade not possible, restrict product‑editing rights to trusted users, implement server‑side sanitization of rich‑text fields, and enable CSP to block inline scripts. Monitor logs for XSS attempts.

Risk context

The vulnerability has a medium CVSS score of 4.8 and no EPSS data, indicating moderate risk. Prompt patching is recommended to prevent potential session hijacking or unauthorized actions.

Affected products

• CubeCart 6.7.4
• CubeCart 6.7.3
• CubeCart 6.6.x
• CubeCart 6.5.x