CVE-2026-39428CWE-79

CubeCart: Stored Cross-Site Scripting (XSS)

Medium · published May 13, 2026

CVSS v3.1
4.8
EPSS
0%
Percentile
14.5
In the wild
Unconfirmed
What it is

CubeCart is an ecommerce software solution. Prior to 6.6.0, a Stored Cross-Site Scripting (XSS) vulnerability exists in CubeCart v6.x. An attacker with administrative privileges can inject malicious JavaScript payloads into multiple fields during the creation or modification of a product. These payloads are stored in the database and executed whenever a user (customer or another administrator) views the affected product pages, which could lead to session hijacking or unauthorized actions. This vulnerability is fixed in 6.6.0.

The record
Technical detail
CVSS v3.1
4.8 · MEDIUM
Vector
CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N
CVSS v4.0
Not supplied
EPSS
0.00242 · 14.5th percentile
Weakness
CWE-79 · Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Published
2026-05-13T20:39Z
EPSS history
Timeline
  • 13 MAY 20:39Z
    CubeCart: Stored Cross-Site Scripting (XSS)
    cvelistv5