---
id: CVE-2026-88905
title: >-
  The KeyWord Collector WordPress plugin through 1.4 does not have any
  authorisation or nonce check when saving its settings, and does not escape
  them before output, allowing unauthenticated attackers to store malicious
  JavaScript that exe…
summary: >-
  The KeyWord Collector WordPress plugin through 1.4 does not have any
  authorisation or nonce check when saving its settings, and does not escape
  them before output, allowing unauthenticated attackers to store malicious
  JavaScript that exe…
severity: high
cvss: 8.8
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H'
cwe:
  - CWE-79
published: '2026-10-11'
updated: '2026-10-11'
sourceUpdated: '2026-10-11T12:17:26.147'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2026-88905'
references:
  - url: 'https://wpscan.com/vulnerability/93503140-af69-4734-bf65-bc781b761c47/'
    label: contact@wpscan.com
tags:
  - nvd
ingestedAt: '2026-10-11T08:44:24.724Z'
epss: 0.00172
epssPercentile: 0.06076
---

## Overview

The KeyWord Collector WordPress plugin through 1.4 does not have any authorisation or nonce check when saving its settings, and does not escape them before output, allowing unauthenticated attackers to store malicious JavaScript that executes when an administrator opens the KeyWord Collector WordPress plugin through 1.4's settings page or when a visitor loads a page displaying its output.

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.