CubeCart ecommerce software versions before 6.6.0 have a stored XSS vulnerability (CWE-79) that allows an attacker with admin privileges to inject malicious scripts into product creation or modification fields. These scripts are stored in the database and executed when the product pages are viewed by customers or administrators. This vulnerability can result in session hijacking or unauthorized actions. The issue is resolved in version 6.6.0.

An attacker with administrative privileges can exploit this vulnerability to inject malicious JavaScript payloads that execute in the context of users viewing the affected product pages. This can lead to session hijacking or unauthorized actions performed by the victim users. The impact is limited by the requirement for administrative privileges to inject the payload and user interaction to trigger execution.

Upgrade CubeCart to version 6.6.0 or later, where this vulnerability is fixed. Since the vendor advisory confirms the fix in 6.6.0, applying this official update is the recommended remediation. No other mitigation steps are specified or required.