---
id: CVE-2026-88905
title: >-
  The KeyWord Collector WordPress plugin through 1.4 does not have any
  authorisation or nonce check when saving its settings, and does not escape
  them before output, allowing unauthenticated attackers to store malicious
  JavaScript that exe…
summary: >-
  The KeyWord Collector WordPress plugin through 1.4 does not have any
  authorisation or nonce check when saving its settings, and does not escape
  them before output, allowing unauthenticated attackers to store malicious
  JavaScript that exe…
severity: high
cvss: 8.8
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H'
cwe:
  - CWE-79
published: '2026-10-11'
updated: '2026-10-13'
sourceUpdated: '2026-10-13T20:36:00.850'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2026-88905'
references:
  - url: 'https://wpscan.com/vulnerability/93503140-af69-4734-bf65-bc781b761c47/'
    label: contact@wpscan.com
tags:
  - nvd
  - cve.org
epss: 0.00276
epssPercentile: 0.19895
ingestedAt: '2026-10-11T08:44:24.724Z'
product: KeyWord Collector
affected:
  - keyword_collector <= 1.4
ssvc:
  exploitation: none
  automatable: 'no'
  technicalImpact: total
  timestamp: '2026-10-11T11:20:02.372397Z'
---

## Overview

The KeyWord Collector WordPress plugin through 1.4 does not have any authorisation or nonce check when saving its settings, and does not escape them before output, allowing unauthenticated attackers to store malicious JavaScript that executes when an administrator opens the KeyWord Collector WordPress plugin through 1.4's settings page or when a visitor loads a page displaying its output.

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.