What’s Vulnerable › Vulnerabilities

CVE-2025-59411: CubeCart Stored/Reflected HTML Injection Vulnerability in Contact Enquiry

• Severity: medium (CVSS 5.4 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.3% probability of exploitation in the next 30 days
• Public exploit or detection template: yes
• Published: 2025-09-22 · updated 2026-06-17
• Weakness: CWE-79

Description

CubeCart is an ecommerce software solution. Prior to version 6.5.11, the contact form’s Enquiry field accepts raw HTML and that HTML is included verbatim in the email sent to the store admin. By submitting HTML in the Enquiry, the admin receives an email containing that HTML. This indicates user input is not being escaped or sanitized before being output in email (and possibly when re-rendering the form), leading to Cross-Site Scripting / HTML injection risk in email clients or admin UI. This issue has been patched in version 6.5.11.

Affected products

• CubeCart Limited CubeCart: before 6.5.11 — fixed in 6.5.11

How to fix

Upgrade to a fixed version: CubeCart Limited CubeCart 6.5.11. Check the vendor advisory for mitigations.

References

• https://github.com/cubecart/v6/commit/299065bd4a8836782ce92f70988c730f130756db
• https://github.com/cubecart/v6/commit/48336c54532705873a8c4106208c2d596f128047
• https://github.com/cubecart/v6/security/advisories/GHSA-5hg3-m3q3-v2p4
• https://github.com/cubecart/v6/security/advisories/GHSA-5hg3-m3q3-v2p4

Get alerted when CVE-2025-59411 or the next vulnerability affects your stack