CVE-2026-8880

Name of the Vulnerable Software and Affected Versions RomanCart Ecommerce versions prior to 2.0.9

Description The RomanCart Ecommerce plugin for WordPress contains a Stored Cross-Site Scripting issue. This occurs due to insufficient input sanitization and output escaping of user-supplied attributes within the romancart button shortcode() function. Authenticated attackers with contributor-level access or higher can inject arbitrary web scripts via the blclass attribute and other attributes of the 'romancart button' shortcode. These scripts execute whenever a user visits the affected page.

Recommendations Update the plugin to a version later than 2.0.8. As a temporary mitigation, restrict the ability of users with contributor-level access to use the 'romancart button' shortcode or the blclass attribute.