CVE-2026-4080 is a stored cross-site scripting vulnerability in the Easy Cart WordPress plugin by zeshanb. The vulnerability arises from insufficient sanitization and escaping of user input in the ectp_add_to_cart() function, which processes shortcode attributes such as 'itemid', 'product_name', 'product_desc', 'product_qty', and 'price'. Although sanitize_text_field() is used, it does not escape double quote characters, enabling attackers to break out of HTML attribute contexts and inject arbitrary JavaScript event handlers. This flaw allows authenticated users with Contributor or higher privileges to inject persistent scripts that execute in the context of any user viewing the compromised page.

An attacker with Contributor-level or higher access can inject malicious scripts into pages via the vulnerable shortcode attributes. These scripts execute whenever any user accesses the infected page, potentially leading to session hijacking, privilege escalation, or other client-side attacks. The vulnerability impacts confidentiality and integrity but does not affect availability.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, restrict Contributor-level access to trusted users only and consider disabling or removing the Easy Cart plugin if possible. Monitor for updates from the vendor regarding an official fix.