Cross-Site Scripting Risk in CubeCart E-Commerce Software
CVE-2025-59411

5.4MEDIUM

Key Information:

Vendor

Cubecart

Status
V6
Vendor
CVE Published:
22 September 2025

What is CVE-2025-59411?

CubeCart, an ecommerce solution, contains a vulnerability where the contact form’s Enquiry field permits the submission of unfiltered HTML. This HTML is subsequently sent to the store administrator in email notifications, without any escaping or sanitization. As a result, this flaw opens the door to Cross-Site Scripting (XSS) attacks within email clients or administrative interfaces. This issue is resolved in version 6.5.11, which addresses the improper handling of user input.

Affected Version(s)

v6 < 6.5.11

References

https://github.com/cubecart/v6/security/advisories/GHSA-5...
x_refsource_CONFIRM
https://github.com/cubecart/v6/commit/299065bd4a8836782ce...
x_refsource_MISC
https://github.com/cubecart/v6/commit/48336c54532705873a8...
x_refsource_MISC

CVSS V3.1

Score:
5.4
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
Low
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
Required
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.
CVE-2025-59411 : Cross-Site Scripting Risk in CubeCart E-Commerce Software