PT-2026-40805 · Cubecart · Cubecart

Published 2026-05-13 · Updated 2026-05-15 · CVE-2026-44376

Positive Technologies (AI Summary)

CVSS v3.1

6.1

Medium

Base vector

AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions CubeCart versions prior to 6.7.0

Description An unauthenticated Reflected Cross-Site Scripting (XSS) issue exists in the search feature. A logic flaw in the classes/catalogue.class.php file allows user input to be reflected without sanitization specifically when a search returns exactly one product. This allows an attacker to execute malicious JavaScript in the victim's browser, which can lead to session hijacking, site defacement, or phishing.

Recommendations Update to version 6.7.0.

Exploit

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2026-44376

Affected Products

Cubecart

References · 5

• 🔥 https://github.com/cubecart/v6/security/advisories/GHSA-gvcp-wpvp-c6f7 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2026-44376 · Security Note
• https://github.com/cubecart/v6/commit/b9d03e20b9d0f443f8ea55fd834e348438e2cc0c · Note
• https://t.me/cveNotify/163678 · Telegram Post
• https://twitter.com/CVEnew/status/2054709216250880480 · Twitter Post