CVE-2026-8880

The RomanCart Ecommerce plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'blclass' attribute (and other attributes) of the romancart_button shortcode in versions up to, and including, 2.0.8. This is due to insufficient input sanitization and output escaping on user supplied attributes within the romancart_button_shortcode() function. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.

• CWE-79

• https://plugins.trac.wordpress.org/browser/romancart-ecommerce/tags/2.0.8/romancart_ecommerce.php#L141
• https://plugins.trac.wordpress.org/browser/romancart-ecommerce/tags/2.0.8/romancart_ecommerce.php#L151
• https://www.wordfence.com/threat-intel/vulnerabilities/id/5d44255b-0615-439d-b166-8f1100f53e3a?source=cve

Published

Jun 9, 2026

Last Modified

Jul 23, 2026

Status

Deferred

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-8879Version 3.0.7 of the Securly Chrome Extension dynamically re…7.5
• CVE-2026-88790A security vulnerability has been detected in proma-ai Proma…4.8
• CVE-2026-88792The Dictionary WordPress plugin through 1.0 does not have au…8.8
• CVE-2026-88793The YouTube Embed WordPress plugin from 10.0 to 10.3 does no…8.8
• CVE-2026-88795The wpShopGermany IT-RECHT KANZLEI WordPress plugin before 2…9
• CVE-2026-88798The Really Simple Security WordPress plugin before 9.8.3 do…5.3
• CVE-2026-88802The MDJM Event Management WordPress plugin before 1.7.8.5 an…7.5
• CVE-2026-88806A malicious X server could exploit a buffer overflow in libX…7.5
• CVE-2026-88807A heap overflow in libXrender before 0.9.13 in RenderQueryPi…8.9
• CVE-2026-8881Version 3.0.7 of the Securly Chrome Extension uses EVP_Bytes…7.5
• CVE-2026-88817An authenticated, non-guest user of Curiosity Workspace coul…8.7
• CVE-2026-88819In Siglet current and past versions the refresh token handle…6.3