CVE-2026-39428: CubeCart: Stored Cross-Site Scripting (XSS)
CubeCart is an ecommerce software solution. Prior to 6.6.0, a Stored Cross-Site Scripting (XSS) vulnerability exists in CubeCart v6.x. An attacker with administrative privileges can inject malicious JavaScript payloads into multiple fields during the creation or modification of a product. These payloads are stored in the database and executed whenever a user (customer or another administrator) views the affected product pages, which could lead to session hijacking or unauthorized actions. This vulnerability is fixed in 6.6.0.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2026-39428?
CVE-2026-39428 is classified as a high severity Stored Cross-Site Scripting (XSS) vulnerability.
How do I fix CVE-2026-39428?
To fix CVE-2026-39428, upgrade CubeCart to version 6.6.0 or later.
Who is affected by CVE-2026-39428?
CVE-2026-39428 affects all CubeCart versions prior to 6.6.0 that allow administrative users to input data.
What kind of attacks can CVE-2026-39428 enable?
CVE-2026-39428 allows attackers with administrative privileges to inject malicious JavaScript payloads, potentially compromising user sessions.
How can I determine if I am vulnerable to CVE-2026-39428?
You can determine if you are vulnerable to CVE-2026-39428 by checking your CubeCart version and ensuring it is 6.6.0 or higher.