CVE-2026-8880 describes a stored cross-site scripting vulnerability in the RomanCart Ecommerce WordPress plugin, affecting versions prior to 2.0.9. The issue stems from improper neutralization of input in the 'blclass' and other attributes of the romancart_button shortcode, due to inadequate sanitization and escaping in the romancart_button_shortcode() function. This allows authenticated users with contributor or higher privileges to inject arbitrary scripts that execute in the context of users viewing the compromised pages. The CVSS 3.1 vector indicates network attack vector, low attack complexity, privileges required at low level, no user interaction needed, scope changed, and low impact on confidentiality and integrity with no impact on availability.

An attacker with contributor-level or higher access can inject persistent malicious scripts into pages via shortcode attributes, leading to cross-site scripting attacks. This can result in unauthorized script execution in users' browsers, potentially compromising user data or session integrity. The vulnerability does not impact availability. The scope is changed, indicating the vulnerability affects resources beyond the attacker’s privileges.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no official fix or patch is indicated, users should monitor the vendor's communications for updates. Until a fix is available, restrict contributor-level access and above to trusted users only to reduce risk. Avoid using the vulnerable shortcode attributes if possible.