CVE-2026-44376: CubeCart: Reflected XSS in Store Search Bar
CubeCart is an ecommerce software solution. Prior to 6.7.0, an unauthenticated Reflected XSS vulnerability exists in the CubeCart v6.x search feature. Due to a logic flaw in classes/catalogue.class.php, user input is reflected without sanitization only when a search returns exactly one product. This flaw bypasses current filters, allowing an attacker to execute malicious JavaScript in the victim's browser, leading to session hijacking, site defacement, or phishing. This vulnerability is fixed in 6.7.0.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2026-44376?
CVE-2026-44376 is classified as a medium severity reflected XSS vulnerability affecting CubeCart prior to version 6.7.0.
How do I fix CVE-2026-44376?
To fix CVE-2026-44376, upgrade CubeCart to version 6.7.0 or later.
What systems are impacted by CVE-2026-44376?
CVE-2026-44376 affects all versions of CubeCart prior to 6.7.0 that utilize the search feature.
What type of vulnerability is CVE-2026-44376?
CVE-2026-44376 is a reflected cross-site scripting (XSS) vulnerability originating from unsanitized user input.
Can CVE-2026-44376 be exploited without authentication?
Yes, CVE-2026-44376 can be exploited by attackers without requiring user authentication.