CubeCart versions before 6.7.0 contain a reflected cross-site scripting (XSS) vulnerability that can be exploited without authentication. This vulnerability allows attackers to inject malicious scripts into web requests that are reflected in responses, potentially compromising user sessions or executing arbitrary scripts in the context of the victim's browser. The affected versions include all 6.x.x releases prior to 6.7.0. No patch or official fix information is provided in the available data.

Successful exploitation of this reflected XSS vulnerability could allow attackers to execute arbitrary JavaScript in the context of users visiting the vulnerable CubeCart site. This may lead to theft of session cookies, redirection to malicious sites, or other client-side attacks. However, no active exploitation in the wild has been reported.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, consider implementing web application firewall (WAF) rules to detect and block reflected XSS attempts and review input validation and output encoding practices in the application.