What is the CVSS score of CVE-2026-39428?

CVE-2026-39428 has a CVSS 3.1 base score of 4.8 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N. EPSS exploitation probability: 0.0%.

Is there a patch available for CVE-2026-39428?

Yes, a patch is available for CVE-2026-39428. Update the affected software to the latest version immediately.

CubeCart CVE-2026-39428

EUVD-2026-30157 MEDIUM

Cross-site Scripting (XSS) (CWE-79)

2026-05-13 GitHub_M

XSS Cubecart V6

4.8

CVSS 3.1 · GitHub Advisory

Severity by source

GitHub Advisory PRIMARY

4.8 MEDIUM

AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N

Primary rating from GitHub Advisory · only source for this CVE.

CVSS VectorGitHub Advisory

Attack Vector

Network

Attack Complexity

Low

Privileges Required

High

User Interaction

Required

Scope

Changed

Confidentiality

Low

Integrity

Low

Availability

None

Lifecycle Timeline

Analysis Generated

Jun 08, 2026 - 11:05 vuln.today

Patch available

May 13, 2026 - 22:03 EUVD

DescriptionGitHub Advisory

CubeCart is an ecommerce software solution. Prior to 6.6.0, a Stored Cross-Site Scripting (XSS) vulnerability exists in CubeCart v6.x. An attacker with administrative privileges can inject malicious JavaScript payloads into multiple fields during the creation or modification of a product. These payloads are stored in the database and executed whenever a user (customer or another administrator) views the affected product pages, which could lead to session hijacking or unauthorized actions. This vulnerability is fixed in 6.6.0.

AnalysisAI

Stored Cross-Site Scripting in CubeCart v6.x (prior to 6.6.0) allows an authenticated administrator to inject persistent malicious JavaScript into product creation or modification fields, which then executes in the browsers of any user - customer or fellow administrator - who views the affected product pages. The attack requires high-privilege access (PR:H) and victim interaction (UI:R), limiting its realistic threat surface to compromised or malicious admin accounts. No public exploit identified at time of analysis via KEV, though SSVC data indicates proof-of-concept code exists; EPSS stands at 0.03% (8th percentile), reflecting low observed exploitation pressure.

Technical ContextAI

CubeCart is a PHP-based ecommerce platform (CPE: cpe:2.3:a:cubecart:v6:*:*:*:*:*:*:*:*) that stores product information - including descriptive fields editable via the admin panel - in a backend database. The root cause is CWE-79 (Improper Neutralization of Input During Web Page Generation), a Stored XSS variant: user-supplied input in product fields is not adequately sanitized before being persisted to the database and subsequently reflected into rendered HTML on product pages. Because the scope is changed (S:C in the CVSS vector), the injected script can affect the security context of users outside the administrative session - specifically, storefront customers - even though the injection originates from within the admin interface. The CVSS vector AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N accurately captures a scenario where complexity is low once admin access is obtained, but the requirement for high privileges and victim interaction meaningfully constrains the attack surface.

RemediationAI

The vendor-released patch is CubeCart 6.6.0, which resolves this vulnerability. Administrators should upgrade to 6.6.0 or later immediately, referencing the official GitHub security advisory at https://github.com/cubecart/v6/security/advisories/GHSA-gvxc-5v7r-272m for upgrade guidance. As a compensating control prior to patching, strictly enforce the principle of least privilege on CubeCart admin accounts - revoke product creation and modification privileges from any accounts where they are not operationally required, as exploitation depends entirely on an actor holding administrative access. Additionally, implement a Web Application Firewall (WAF) rule set targeting stored XSS patterns on product submission endpoints to reduce injection success rates, though this carries a trade-off of potential false positives on legitimate HTML product descriptions. Content Security Policy (CSP) headers on product pages can also reduce the impact of successful injection by restricting script execution contexts, though CSP deployment may require testing against existing CubeCart front-end functionality.