Ten responsibly disclosed vulnerabilities were fixed across three CubeCart releases, including one rated CVSS 9.0. Here is what was found, and why authenticated-only is less reassuring than it sounds.
Reviews are the one thing on a product page customers actually believe. Here is how to ask for them properly, how to handle bad ones, and what the DMCC Act now requires of you.
UK and EU distance selling rules give customers a cooling off period. CubeCart 6.7.4 added a proper request workflow with states, automatic acknowledgements and an audit trail.
CubeCart 6.7.4 added a statutory cancellation workflow for UK and EU merchants, a proper command line cron runner, and gzip compression of order baskets.
Magecart injects JavaScript into your checkout to copy card details as customers type. The shop keeps working, the order completes, and nothing looks broken. Here is how it gets in and what actually reduces the risk.
One shared image component everywhere, image search across the file manager, per-option product images, and uploads that select themselves. Plus the protective htaccess worth checking after a migration.
CubeCart now records every admin action with actor, IP and a diff, logs outbound HTTP calls, and deduplicates error rows so the log is actually readable.
CubeCart email now sends asynchronously via cron, tracks opens, and generates plain text automatically. It also shipped with a bug that sent blank order confirmations, fixed in 6.7.2.
CubeCart 6.8.0 brings Atrium, a new default storefront skin, a stock audit log, verified reviews and confirmed sign-ups. What it changes and what to check.
Seven built-in reports with xlsx export, including the Search Terms report that tells you what shoppers looked for and did not find. Plus the pagination bug that made earlier exports unreliable.