Cross-Site Scripting Vulnerability in CubeCart E-commerce Solution

CVE-2026-54644

What is CVE-2026-54644?

CubeCart, a popular e-commerce software solution, has a vulnerability in the _errorMessage method located in classes/gui.class.php. This issue arises from the method's use of strip_tags, which allows for the inclusion of anchor elements while failing to sanitize unsafe href values and event handlers thoroughly. As a result, maliciously crafted input data can be displayed in user interface messages, potentially allowing attackers to inject JavaScript code into the browser session of a victim who interacts with the rendered content. Consequently, this could lead to session exposure or unauthorized actions within the application. The vulnerability is addressed in version 6.7.5.

References