Read the docs
TI-2026-28409 Aliases CVE-2026-39428

CubeCart: Stored Cross-Site Scripting (XSS)

Priority MEDIUM 55CWE-79Published · Updated

Key facts

Attack vector
Network
Privileges required
High
User interaction
Required
Attack complexity
Low
Impact type
Cross-site scripting
Confidentiality · integrity · availability
Low · Low · None
Fix status
Fixed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA. Impact type from CWE-79.

Summary

CubeCart is an ecommerce software solution. Prior to 6.6.0, a Stored Cross-Site Scripting (XSS) vulnerability exists in CubeCart v6.x. An attacker with administrative privileges can inject malicious JavaScript payloads into multiple fields during the creation or modification of a product. These payloads are stored in the database and executed whenever a user (customer or another administrator) views the affected product pages, which could lead to session hijacking or unauthorized actions. This vulnerability is fixed in 6.6.0.

Why it matters now

Exploitation Proof of concept CISA SSVC · not in CISA KEV
EPSS 0.00173 6th percentileScored 2026-11-07
Fix Fixed v6 (cubecart): 6.6.0

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
Poc
Automatable
No
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
cubecartv6before 6.6.06.6.0Patch availableCNA
  • v6 Vendorcubecart Affected before 6.6.0 Fixed in 6.6.0 Patch available CNA

CPE names Threatist (inferred) · 1

Inferred from how NVD named this product before; not given by a source.

CPEVersionsRoleVendor
cpe:2.3:a:cubecart:cubecart:*:*:*:*:*:*:*:*——cubecart
  • cpe:2.3:a:cubecart:cubecart:*:*:*:*:*:*:*:* Versions — — ·cubecart

Remediation

  • Fix · CNA v6 (cubecart) Fixed in 6.6.0

Timeline

  1. 2026-10-02 Threatist record created from CVE-2026-39428

References

Other 1

  • TI-2024-23117 Directory Traversal vulnerability in CubeCart v.6.5.5 and before allows an attacker to… CVSS 3.1CRITICAL 9.8
  • TI-2026-33453 CubeCart: Server-Side Template Injection (SSTI) in Smarty Templates leading to RCE CVSS 3.1CRITICAL 9.1
  • TI-2026-32902 CubeCart: Authenticated Arbitrary File Upload to RCE in REST Files API CVSS 3.1CRITICAL 9.1
  • TI-2026-32334 CubeCart: Server-Side Template Injection (SSTI) in Smarty Templates leading to RCE CVSS 3.1CRITICAL 9.1
  • TI-2026-32904 CubeCart: Pre-Authenticated Password Reset Link Poisoning via HTTP Host Header CVSS 3.1HIGH 8.1
  • TI-2024-22066 File Upload vulnerability in CubeCart before 6.5.5 allows an authenticated user to… CVSS 3.1HIGH 8.0
See all 44 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences