RomanCart Ecommerce
RomanCart Ecommerce has one disclosed vulnerability in the WordSec catalog, all reported in 2026; it remains unpatched as of October 2026. Their average CVSS score is 6.4, and the most serious one scores 6.4 out of 10.
The most common weakness is Cross-Site Scripting, behind 1 of the records (100%).
The one issue recorded for RomanCart Ecommerce has no published fix yet, which makes virtual patching the only reliable mitigation. The oldest unresolved one dates back to 2026.
All of these findings were reported by Gilang - DJ. RomanCart Ecommerce is installed on roughly 10 WordPress sites, so each unpatched flaw has a wide blast radius. The current release is tested up to WordPress 7.1.3.
CVE-2026-8880RomanCart Ecommerce <= 2.0.8 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode Attributes
Read the full analysisVulnerability Records
RomanCart Ecommerce
Author
romancartsupport
Add Buy Buttons, Widgets or an entire Storefront to your pages and sell products, tickets and digital downloads in minutes. Tickets are generated automatically with QR codes for validation with a phone at the door. Digital downloads are delivered via a 48 hour time limited hyperlink. Buy Buttons allow your customers to click on the buttons and be taken to your cart where tax and shipping is selected and calculated and payment is taken. Widgets are enhanced buy buttons with Social Media buttons, stock display and currency conversion. RomanCart Storefront is an embedded, categorised product display, shopping cart and purchasing tool, designed to effortlessly and stylishly convert any website into a full ecommerce website. The RomanCart Ecommerce WordPress plugin extends these features to our WordPress users. By installing and activating the plugin, you’ll be able to run your RomanCart Storefront on your WordPress website. All you need to do is activate the plugin and add your RomanCart Store ID. www.romancart.com
Vulnerability data © Defiant, Inc., provided under the Wordfence Intelligence T&C