An unauthenticated reflected cross-site scripting vulnerability affects CubeCart versions before 6.7.0. Tracked as CVE-2026-44376, it lets an attacker inject malicious JavaScript through the search or catalogue modules — no login required.
The attack is almost embarrassingly simple. You head to the store’s search bar, type in a product name that returns exactly one result, and append a script tag. Hit enter, and the payload fires in the victim’s browser. The catch? The search has to match precisely one product. Zero results or multiple results and nothing happens.
There’s also a direct-link variant that skips the search bar entirely — just craft a URL with the payload in the keywords parameter and send it to a target. Classic reflected XSS, but the unauthenticated nature makes it worse than it sounds at first glance.
If you’re running CubeCart, check your version. Anything below 6.7.0 needs an update yesterday. If you can’t patch immediately, consider putting a WAF rule in place to filter script tags in search queries. It’s not a permanent fix, but it’ll blunt the impact while you schedule the upgrade.
