CVE-2026-8880: RomanCart WordPress Plugin XSS Vulnerability

CVE-2026-8880 Overview

CVE-2026-8880 is a Stored Cross-Site Scripting (XSS) vulnerability [CWE-79] in the RomanCart Ecommerce plugin for WordPress. The flaw affects all versions up to and including 2.0.8. It resides in the romancart_button_shortcode() function, which fails to properly sanitize and escape user-supplied attributes of the romancart_button shortcode, including the blclass attribute. Authenticated attackers with contributor-level access or higher can inject arbitrary JavaScript into pages. The injected scripts execute in the browser of any user who visits an affected page, enabling session theft, redirection, and unauthorized actions within the WordPress site context.

Critical Impact
Authenticated contributors can persistently inject JavaScript that executes in every visitor's browser, including administrators, enabling account compromise and site takeover scenarios.

Affected Products

RomanCart Ecommerce plugin for WordPress, versions up to and including 2.0.8
WordPress sites that allow contributor-level (or higher) user registration
WordPress installations using the vulnerable romancart_button shortcode

Discovery Timeline

2026-06-09 - CVE-2026-8880 published to NVD
2026-06-09 - Last updated in NVD database

Technical Details for CVE-2026-8880

Vulnerability Analysis

The vulnerability resides in the romancart_button_shortcode() function within romancart_ecommerce.php (lines 141 and 151 in the version 2.0.8 source). This function processes shortcode attributes supplied by users when rendering the RomanCart button on a WordPress post or page. The handler accepts attributes such as blclass and inserts their values into the rendered HTML output without applying input sanitization or output escaping. As a result, an authenticated user with contributor privileges or above can place a [romancart_button] shortcode containing malicious attribute values into post content. WordPress stores the payload in the database, and the script executes whenever any visitor renders the page.

Root Cause

The root cause is missing input validation and missing output escaping for shortcode attributes. WordPress provides helper functions such as esc_attr() and wp_kses() for safely rendering user-controlled values into HTML attribute contexts. The vulnerable shortcode handler concatenates the raw blclass value (and other attributes) directly into the generated markup, breaking out of the intended attribute context when the value contains quotes or angle brackets.

Attack Vector

An attacker authenticated as a contributor creates or edits a post containing the romancart_button shortcode with a crafted blclass attribute. The payload uses quote-breakout characters to inject a new HTML attribute such as an event handler, or terminates the tag entirely to insert a <script> element. Once an editor or administrator previews the post, or once the post is published and viewed, the JavaScript executes in the victim's session with full access to cookies, the DOM, and authenticated REST API endpoints.

No verified public exploit code is currently available. Refer to the Wordfence Vulnerability Report and the WordPress plugin source at romancart_ecommerce.php line 141 and line 151 for the vulnerable code paths.

Detection Methods for CVE-2026-8880

Indicators of Compromise

Post or page content containing [romancart_button] shortcodes with unusual attribute values, especially blclass values containing quotes, angle brackets, javascript:, or on* event handlers
Database wp_posts.post_content entries that include <script>, onerror=, or onclick= adjacent to RomanCart shortcode tags
Unexpected outbound requests from visitor browsers to attacker-controlled domains after rendering pages with RomanCart buttons

Detection Strategies

Query the WordPress database for post_content LIKE '%romancart_button%' and review results for malicious attribute values
Inspect rendered HTML output of affected pages for injected <script> tags or event handlers tied to shortcode-generated elements
Review WordPress audit logs for contributor accounts that submitted or edited posts containing the romancart_button shortcode

Monitoring Recommendations

Enable WordPress activity logging to track post creation and revisions by contributor-level accounts
Deploy a Web Application Firewall (WAF) with rules that block XSS payload patterns in POST requests to /wp-admin/post.php
Forward web server and WordPress logs to a centralized SIEM or data lake to correlate contributor edits with subsequent client-side anomalies

How to Mitigate CVE-2026-8880

Immediate Actions Required

Deactivate the RomanCart Ecommerce plugin until a patched version is installed
Audit all existing posts and pages for the romancart_button shortcode and remove or sanitize suspicious attribute values
Review contributor-level and author-level accounts; suspend or reset credentials for accounts that should not have publishing capabilities
Force a password reset for administrators whose sessions may have rendered affected pages

Patch Information

As of the NVD publication date, all versions up to and including 2.0.8 are vulnerable. Monitor the WordPress plugin repository for RomanCart Ecommerce and the Wordfence advisory for an updated release that applies esc_attr() and wp_kses() to shortcode attributes.

Workarounds

Restrict the unfiltered_html and publish_posts capabilities for contributor and author roles using a role management plugin
Disable the romancart_button shortcode site-wide via remove_shortcode('romancart_button') in a must-use plugin until an official fix is released
Deploy WAF signatures that block shortcode attribute values containing <, >, ", or javascript: patterns submitted to post editing endpoints

bash

# Temporary mitigation: disable the vulnerable shortcode
# Place in wp-content/mu-plugins/disable-romancart-button.php
<?php
add_action('init', function () {
    remove_shortcode('romancart_button');
}, 99);