CVE-2026-54644: medium-severity vulnerability in cubecart v6
CubeCart: XSS via Anchor Tag Attribute Injection in gui.class.php Message System
Published · Updated
E-mail alert when it lands in KEV, gets a public PoC or its score goes up.
33Vexday Risk Score
No sign of exploitation. It has a public proof of concept.
ssvc Attendcvss 6.1epss 0.9%
from disclosure to weaponsame day
Published on NVDSep 17
1st PoCAug 31
CubeCart is an ecommerce software solution. Prior to 6.7.5, the _errorMessage method in classes/gui.class.php uses strip_tags to permit anchor elements in error, information, and warning messages while retaining unsafe href values and onclick event handlers. Attacker-controlled search or input data that reaches a GUI message can carry a javascript: URI or event handler through the filter, and viewing or interacting with the rendered anchor executes JavaScript in the victim's browser session, enabling session exposure or unauthorized application actions. This issue is fixed in version 6.7.5.
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Affected products
cubecart · v6public PoCs found — 1
exploitdbwww.exploit-db.com/exploits/52661unverified⚠ Public resources, to assess the exposure of systems you control or are authorized to test. Test only with authorization.
Related CVEs — cubecart v6
In the same product, most dangerous first.
CVE-2026-54647HIGHCubeCart : SQL Injection via download_expire Parameter in settings.index.inc.phpEPSS 1.4%CVE-2026-54646HIGHCubeCart: SQL Identifier Injection via Backtick Bypass in maintenance.index.inc.phpEPSS 1.4%CVE-2026-54645MEDIUMCubeCart: Stored XSS in Product Description Editor via Global Sanitizer BypassEPSS 1.1%CVE-2026-44377CRITICALCubeCart: Server-Side Template Injection (SSTI) in Smarty Templates leading to RCEEPSS 0.7%CVE-2026-44376MEDIUMCubeCart: Reflected XSS in Store Search BarEPSS 0.7%CVE-2026-54648MEDIUMCubeCart: Missing Authorization Check in customers.gdpr.inc.php Leads to Unauthorized Customer Data DeletionEPSS 0.6%