CVE-2026-54644

CubeCart is an ecommerce software solution. Prior to 6.7.5, the _errorMessage method in classes/gui.class.php uses strip_tags to permit anchor elements in error, information, and warning messages while retaining unsafe href values and onclick event handlers. Attacker-controlled search or input data that reaches a GUI message can carry a javascript: URI or event handler through the filter, and viewing or interacting with the rendered anchor executes JavaScript in the victim's browser session, enabling session exposure or unauthorized application actions. This issue is fixed in version 6.7.5.

• CWE-79

• https://github.com/cubecart/v6/blob/6.7.5/admin/sources/release_notes/6.7.5.inc.php
• https://github.com/cubecart/v6/commit/7c4c0081fd346578a95738f480ef647116ee1c82
• https://github.com/cubecart/v6/releases/tag/6.7.5
• https://github.com/cubecart/v6/security/advisories/GHSA-v55x-fh73-29vq
• https://github.com/cubecart/v6/security/advisories/GHSA-v55x-fh73-29vq

Published

Sep 17, 2026

Last Modified

Sep 23, 2026

Status

Awaiting Analysis

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-54637Dragonfly is an open source P2P-based file distribution and …5.5
• CVE-2026-54638gotd/td is a T Telegram MTProto API client in Go. Prior to 0…7.5
• CVE-2026-54639Style Dictionary, a build system for creating cross-platform…8.8
• CVE-2026-5464The ExactMetrics – Google Analytics Dashboard for WordPress …7.2
• CVE-2026-54642CubeCart is an ecommerce software solution. Prior to 6.7.5, …5.3
• CVE-2026-54643CubeCart is an ecommerce software solution. Prior to 6.7.5, …5.4
• CVE-2026-54645CubeCart is an ecommerce software solution. Prior to 6.7.5, …4.8
• CVE-2026-54646CubeCart is an ecommerce software solution. Prior to 6.7.5, …7.2
• CVE-2026-54647CubeCart is an ecommerce software solution. Prior to 6.7.5, …7.2
• CVE-2026-54648CubeCart is an ecommerce software solution. Prior to 6.7.5, …6.5
• CVE-2026-54649punchin-email is a Cloudflare Email Worker that provides two…2.1
• CVE-2026-5465The Booking for Appointments and Events Calendar – Amelia pl…8.8