CubeCart ecommerce software versions before 6.6.0 have a stored XSS vulnerability (CWE-79) where an attacker with admin rights can inject malicious JavaScript payloads into product creation or modification fields. These payloads persist in the database and execute when product pages are viewed by customers or administrators, enabling potential session hijacking or unauthorized actions. The vulnerability is addressed in CubeCart v6.6.0.

An attacker with administrative privileges can exploit this vulnerability to inject malicious scripts that execute in the context of users viewing the affected product pages. This can lead to session hijacking or unauthorized actions performed on behalf of users. The vulnerability does not affect availability but impacts confidentiality and integrity to a limited extent.

Upgrade CubeCart to version 6.6.0 or later where this stored XSS vulnerability is fixed. Since the vendor advisory confirms the fix in 6.6.0, applying this official update is the recommended remediation. No other mitigation details are provided.