CVE-2026-54645

Name of the Vulnerable Software and Affected Versions CubeCart versions prior to 6.7.5

Description An issue exists where the file 'admin/sources/products.index.inc.php' reads rich-text fields from the $GLOBALS['RAW']['POST'] variable and only removes script elements before storing and rendering them via Smarty templates. An administrator with product-editing privileges can bypass this filter by using event-handler attributes, SVG content, or javascript: URIs. This leads to persistent JavaScript execution when a storefront visitor or another administrator views the product content, potentially resulting in session exposure or unauthorized actions within the browser context.

Recommendations Update to version 6.7.5.