CubeCart versions before 6.7.0 contain a reflected XSS vulnerability that can be triggered without requiring user authentication. This type of vulnerability allows attackers to inject malicious scripts into web pages viewed by other users, potentially leading to session hijacking, defacement, or other client-side attacks. No detailed technical information or exploitation methods are provided in the source data.

Successful exploitation could allow attackers to execute arbitrary scripts in the context of the victim's browser, potentially leading to theft of session tokens, redirection to malicious sites, or other client-side impacts. However, there is no indication of known exploits in the wild at this time.

A fix is available in CubeCart version 6.7.0 and later. Users should upgrade to version 6.7.0 or newer to remediate this vulnerability. No vendor advisory was provided, so patch status beyond this is not confirmed. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance.