CVE-2026-54644

Name of the Vulnerable Software and Affected Versions CubeCart versions prior to 6.7.5

Description The errorMessage() function in classes/gui.class.php uses strip tags to allow anchor elements in error, information, and warning messages. However, it fails to filter unsafe href values and onclick event handlers. An attacker can provide malicious search or input data that bypasses the filter using a javascript: URI or event handler. When a user views or interacts with the rendered anchor, JavaScript is executed in their browser session, which can lead to session exposure or unauthorized application actions.

Recommendations Update to version 6.7.5.