CVE-2026-8880 is a stored cross-site scripting vulnerability in the RomanCart Ecommerce WordPress plugin (up to version 2.0.8). It occurs due to improper neutralization of input in the 'blclass' attribute and other attributes of the romancart_button shortcode, specifically in the romancart_button_shortcode() function. Authenticated users with contributor-level privileges or higher can inject malicious scripts that persist and execute in the context of any user viewing the compromised page. The vulnerability has a CVSS 3.1 base score of 6.4 (AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N), reflecting network attack vector, low attack complexity, and partial impact on confidentiality and integrity with no impact on availability. No vendor advisory or patch is currently available.

An attacker with contributor-level or higher access can inject persistent malicious scripts into pages via the vulnerable shortcode attributes. These scripts execute in the context of users visiting the infected pages, potentially leading to partial confidentiality and integrity impacts such as session hijacking or unauthorized actions performed on behalf of users. There is no impact on availability. No known exploits have been reported in the wild.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict contributor-level access to trusted users only and consider removing or disabling the RomanCart Ecommerce plugin if possible to prevent exploitation.