Read the docs
TI-2026-39471 Aliases CVE-2026-54644

CubeCart: XSS via Anchor Tag Attribute Injection in gui.class.php Message System

Priority MEDIUM 60CWE-79Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
Required
Attack complexity
Low
Impact type
Cross-site scripting
Confidentiality · integrity · availability
Low · Low · None
Fix status
Fixed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA. Impact type from CWE-79.

Summary

CubeCart is an ecommerce software solution. Prior to 6.7.5, the _errorMessage method in classes/gui.class.php uses strip_tags to permit anchor elements in error, information, and warning messages while retaining unsafe href values and onclick event handlers. Attacker-controlled search or input data that reaches a GUI message can carry a javascript: URI or event handler through the filter, and viewing or interacting with the rendered anchor executes JavaScript in the victim's browser session, enabling session exposure or unauthorized application actions. This issue is fixed in version 6.7.5.

Why it matters now

Exploitation Proof of concept CISA SSVC · not in CISA KEV
EPSS 0.00899 59th percentileScored 2026-11-07
Fix Fixed v6 (cubecart): 6.7.5

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
Poc
Automatable
No
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
cubecartv6before 6.7.56.7.5Patch availableCNA
  • v6 Vendorcubecart Affected before 6.7.5 Fixed in 6.7.5 Patch available CNA

CPE names Threatist (inferred) · 1

Inferred from how NVD named this product before; not given by a source.

CPEVersionsRoleVendor
cpe:2.3:a:cubecart:cubecart:*:*:*:*:*:*:*:*——cubecart
  • cpe:2.3:a:cubecart:cubecart:*:*:*:*:*:*:*:* Versions — — ·cubecart

Remediation

  • Fix · CNA v6 (cubecart) Fixed in 6.7.5

Timeline

  1. 2026-10-02 Threatist record created from CVE-2026-54644

References

Other 4

  • TI-2024-23117 Directory Traversal vulnerability in CubeCart v.6.5.5 and before allows an attacker to… CVSS 3.1CRITICAL 9.8
  • TI-2026-33453 CubeCart: Server-Side Template Injection (SSTI) in Smarty Templates leading to RCE CVSS 3.1CRITICAL 9.1
  • TI-2026-32902 CubeCart: Authenticated Arbitrary File Upload to RCE in REST Files API CVSS 3.1CRITICAL 9.1
  • TI-2026-32334 CubeCart: Server-Side Template Injection (SSTI) in Smarty Templates leading to RCE CVSS 3.1CRITICAL 9.1
  • TI-2026-32904 CubeCart: Pre-Authenticated Password Reset Link Poisoning via HTTP Host Header CVSS 3.1HIGH 8.1
  • TI-2024-22066 File Upload vulnerability in CubeCart before 6.5.5 allows an authenticated user to… CVSS 3.1HIGH 8.0
See all 44 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences