CVE-2026-54645mediumCWE-79

CVE-2026-54645: medium-severity vulnerability in cubecart v6

CubeCart: Stored XSS in Product Description Editor via Global Sanitizer Bypass

Published · Updated

Follow this CVE

E-mail alert when it lands in KEV, gets a public PoC or its score goes up.

33Vexday Risk Score

No sign of exploitation. It has a public proof of concept.

ssvc Attendcvss 4.8epss 1.1%
from disclosure to weaponsame day
Published on NVDSep 17
1st PoCAug 31
CubeCart is an ecommerce software solution. Prior to 6.7.5, admin/sources/products.index.inc.php reads the description, description_short, and spec_copy rich-text fields from $GLOBALS['RAW']['POST'] and removes only script elements before the values are stored and rendered through Smarty templates. An administrator with product-editing rights can store event-handler attributes, SVG content, or javascript: URIs that bypass this filter, causing persistent JavaScript execution when a storefront visitor or another administrator views the product content and enabling session exposure or unauthorized browser-context actions. This issue is fixed in version 6.7.5.
CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N
Affected products
cubecart · v6
⚠ Public resources, to assess the exposure of systems you control or are authorized to test. Test only with authorization.
Related CVEs — cubecart v6

In the same product, most dangerous first.

CVE-2026-54647HIGHCubeCart : SQL Injection via download_expire Parameter in settings.index.inc.phpEPSS 1.4%CVE-2026-54646HIGHCubeCart: SQL Identifier Injection via Backtick Bypass in maintenance.index.inc.phpEPSS 1.4%CVE-2026-54644MEDIUMCubeCart: XSS via Anchor Tag Attribute Injection in gui.class.php Message SystemEPSS 0.9%CVE-2026-44377CRITICALCubeCart: Server-Side Template Injection (SSTI) in Smarty Templates leading to RCEEPSS 0.7%CVE-2026-44376MEDIUMCubeCart: Reflected XSS in Store Search BarEPSS 0.7%CVE-2026-54648MEDIUMCubeCart: Missing Authorization Check in customers.gdpr.inc.php Leads to Unauthorized Customer Data DeletionEPSS 0.6%