CubeCart versions prior to 6.6.0 contain a stored XSS flaw that allows an attacker with administrative privileges to embed malicious JavaScript into product fields during creation or editing. The payload is persisted in the database and executed whenever anyone—customers or other administrators—views the affected product page, potentially enabling session hijacking or the execution of unauthorized actions.

The vulnerability affects the CubeCart ecommerce platform, versions 6.x before the 6.6.0 release. All installations using these pre‑updated versions are susceptible.

The CVSS score of 4.8 indicates moderate severity, with no EPSS data available and the vulnerability not listed in CISA's KEV catalog. Only users with administrative rights can inject the payload, meaning that external attackers must first compromise an administrator account or obtain privileged access. Once privileged, exploitation is straightforward, and the impact includes potential compromise of user sessions and unauthorized operations.