The RomanCart Ecommerce plugin for WordPress is vulnerable to a stored cross‑site scripting flaw caused by insufficient sanitization and escaping of user supplied attributes in the romancart_button shortcode. Authenticated users with contributor or higher privileges can inject arbitrary JavaScript into a button’s attributes such as blclass. Whenever a visitor loads a page containing that button, the injected script runs in their browser, allowing session hijacking, credential theft, or defacement of the site.

WordPress sites employing the RomanCart Ecommerce plugin, version 2.0.8 or earlier, are affected. Any user who can add or edit the romancart_button shortcode—contributors and above—can exploit this flaw.

The flaw carries a CVSS score of 6.4, indicating moderate severity. Although the EPSS score is not available and the vulnerability is not listed in CISA’s KEV catalog, the need for authenticated access limits the threat to sites with exposed contributor role permissions. The stored XSS payload can hijack user sessions and exfiltrate data, making the risk significant for any site users.