CubeCart 3.0.3 contains a flaw that allows a remote cross site scripting attack. Exploitation provided.