Matrix multiplication in which both matrices are CVX variables or expressions is a violation of DCP rules, and is not allowed by CVX.
If a constraint involving multiplication of matrix variables actually is convex (but many such constraints are not convex), in some cases it can be reformulated to comply with CVX’s rules, as for example in my post at How to deal trace(X^H*A*X) in cvx