CVE-2026-88905: KeyWord Collector <= 1.4 - Unauthenticated Stored XSS and Settings Update via WPKeyWordSettings
Published Oct 11, 2026
·Updated
The KeyWord Collector WordPress plugin through 1.4 does not have any authorisation or nonce check when saving its settings, and does not escape them before output, allowing unauthenticated attackers to store malicious JavaScript that executes when an administrator opens the KeyWord Collector WordPress plugin through 1.4's settings page or when a visitor loads a page displaying its output.
Affected Software
1 affected component
WordPress KeyWord Collector<=1.4
Event History
Oct 11, 2026
CVE Published
via MITRE·06:00 AM
Data Sourced
via MITRE·06:00 AM
DescriptionWeakness
Data Sourced
via NVD·07:17 AM
DescriptionSeverityWeakness
Frequently Asked Questions
1
Who can exploit this issue, and when does the injected code run?
No authentication is required to save malicious settings. The stored JavaScript executes when an administrator opens the plugin settings page or when a visitor loads a page that displays the plugin's output.
2
What security controls are missing from the vulnerable settings update path?
The plugin does not perform an authorization check or nonce check when saving settings. It also does not escape those settings before outputting them.