Stored XSS Vulnerability in CubeCart E-commerce Software
CVE-2026-39428

4.8MEDIUM

Key Information:

Vendor

Cubecart

Status
V6
Vendor
CVE Published:
13 May 2026

What is CVE-2026-39428?

CubeCart, a popular e-commerce platform, is impacted by a Stored Cross-Site Scripting (XSS) vulnerability in versions prior to 6.6.0. This flaw allows attackers with administrative privileges to inject malicious JavaScript payloads within various input fields during product creation or modification. These payloads are subsequently saved in the database and executed whenever a user, including other administrators or customers, accesses the affected product pages. This malicious execution can lead to severe exploitation, including session hijacking and unauthorized actions by the attacker. The vulnerability has been addressed and resolved in CubeCart version 6.6.0.

Affected Version(s)

v6 < 6.6.0

References

https://github.com/cubecart/v6/security/advisories/GHSA-g...
x_refsource_CONFIRM

CVSS V3.1

Score:
4.8
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
Low
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
High
User Interaction:
Required
Scope:
Changed

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.