CVE-2026-44376 is a reflected XSS vulnerability in CubeCart v6 ecommerce software versions before 6.7.0. The flaw exists in classes/catalogue.class.php where user input is reflected without proper sanitization only when a search query returns exactly one product. This bypasses existing filters and enables execution of arbitrary JavaScript in the context of the victim's browser. The vulnerability has a CVSS 3.1 base score of 6.1, indicating medium severity. It requires no privileges but does require user interaction (UI:R). The vulnerability is resolved in CubeCart v6.7.0.

Successful exploitation allows an attacker to execute arbitrary JavaScript in the victim's browser, potentially leading to session hijacking, site defacement, or phishing attacks. The vulnerability affects confidentiality and integrity but does not impact availability. It is exploitable remotely without authentication but requires the victim to interact with a crafted link or page.

This vulnerability is fixed in CubeCart version 6.7.0. Users and administrators should upgrade to version 6.7.0 or later to remediate this issue. Patch status is not explicitly stated beyond this version fix, so verifying the upgrade and applying it is the recommended mitigation.