What is the CVSS score of CVE-2026-8880?

CVE-2026-8880 has a CVSS 3.1 base score of 6.4 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N. EPSS exploitation probability: 0.0%.

RomanCart Ecommerce CVE-2026-8880

EUVD-2026-35305 MEDIUM

Cross-site Scripting (XSS) (CWE-79)

2026-06-09 Wordfence

GHSA-6h5g-2c23-pj45

XSS WordPress

6.4

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

6.4 MEDIUM

AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Changed

Confidentiality

Low

Integrity

Low

Availability

None

Lifecycle Timeline

Analysis Generated

Jun 09, 2026 - 05:17 vuln.today

CVE Published

Jun 09, 2026 - 03:41 nvd

MEDIUM 6.4

DescriptionCVE.org

The RomanCart Ecommerce plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'blclass' attribute (and other attributes) of the romancart_button shortcode in versions up to, and including, 2.0.8. This is due to insufficient input sanitization and output escaping on user supplied attributes within the romancart_button_shortcode() function. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.

AnalysisAI

Stored Cross-Site Scripting in the RomanCart Ecommerce WordPress plugin (versions ≤2.0.8) allows authenticated attackers holding contributor-level access or above to inject persistent malicious scripts via the 'blclass' attribute - and other attributes - of the romancart_button shortcode. The injected payload executes in any visitor's browser upon page load, enabling session hijacking, credential theft, or administrative account takeover. No public exploit identified at time of analysis and the vulnerability is not listed in CISA KEV, but the low attack complexity and changed scope (S:C) elevate real-world concern for multi-author WordPress deployments.

Technical ContextAI

The root cause is CWE-79 (Improper Neutralization of Input During Web Page Generation - Stored XSS), specifically within the romancart_button_shortcode() function of the RomanCart Ecommerce plugin (cpe:2.3:a:romancartsupport:romancart_ecommerce:*:*:*:*:*:*:*:*). Source code inspection at plugins.trac.wordpress.org confirms the vulnerable logic at lines 141 and 151 of romancart_ecommerce.php in the 2.0.8 release tag - WordPress shortcode attributes such as 'blclass' are passed directly into rendered HTML output without adequate sanitization (e.g., esc_attr() or wp_kses()) or output encoding. WordPress shortcodes are a common injection surface in plugins because attribute values flow from user-controlled post content into page HTML without the same scrutiny applied to direct form inputs.

RemediationAI

No patched version is confirmed from available data - the CPE wildcard covers all versions through 2.0.8 and neither the Wordfence advisory nor the plugin source code references identify a fixed release. Administrators should immediately check the WordPress Plugin Repository for a version newer than 2.0.8 and upgrade if available, monitoring the Wordfence advisory at https://www.wordfence.com/threat-intel/vulnerabilities/id/5d44255b-0615-439d-b166-8f1100f53e3a for patch confirmation. As a compensating control, deactivate the RomanCart Ecommerce plugin until a fix is confirmed - this removes the vulnerable shortcode handler entirely, with the trade-off of disabling ecommerce functionality. If deactivation is not feasible, immediately audit and revoke contributor-level accounts belonging to untrusted users, and consider disabling open contributor registration. A Web Application Firewall (WAF) rule targeting the romancart_button shortcode's attribute fields can provide an additional detection layer but should not be treated as a primary fix.