CVE-2026-54644: CubeCart: XSS via Anchor Tag Attribute Injection in gui.class.php Message System
CubeCart is an ecommerce software solution. Prior to 6.7.5, the errorMessage method in classes/gui.class.php uses striptags to permit anchor elements in error, information, and warning messages while retaining unsafe href values and onclick event handlers. Attacker-controlled search or input data that reaches a GUI message can carry a javascript: URI or event handler through the filter, and viewing or interacting with the rendered anchor executes JavaScript in the victim's browser session, enabling session exposure or unauthorized application actions. This issue is fixed in version 6.7.5.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
CubeCartto a version that resolves this vulnerability.Fixed in 6.7.5
Event History
Frequently Asked Questions
Which CubeCart deployments need to be updated?
CubeCart versions earlier than 6.7.5 are affected. The issue is fixed in version 6.7.5.
What must happen for exploitation to succeed?
Attacker-controlled search or other input data must reach an error, information, or warning GUI message. A victim must then view or interact with the rendered anchor containing the unsafe URI or event handler.
Who is at risk if a vulnerable instance is exposed?
Users whose browser sessions render the affected GUI messages are at risk. Successful script execution can expose their session or perform unauthorized actions in the application.