Track vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
8.8
CVE-2026-88905: KeyWord Collector plugin lets attackers run code
CVE-2026-88905 · published 7 days ago
Summary
The KeyWord Collector plugin for WordPress allows anyone to change its settings without checking who they are, and it does not protect the data it stores. Because of this, a malicious person can place hidden code that will run for administrators opening the settings page and for any visitor viewing pages that show the plugin’s output. Install the latest version of the plugin or remove it if no update is available, and review the site for any injected code.
What to do
The CVE record does not list a fixed version. Check the vendor's site or the advisory links below - a fix may already be released.
Affected software
| Vendor | Product | Affected versions |
|---|---|---|
| unknown | keyword collector | <= 1.4 |
Original advisory text
KeyWord Collector <= 1.4 - Unauthenticated Stored XSS and Settings Update via WPKeyWordSettings
The KeyWord Collector WordPress plugin through 1.4 does not have any authorisation or nonce check when saving its settings, and does not escape them before output, allowing unauthenticated attackers to store malicious JavaScript that executes when an administrator opens the KeyWord Collector WordPress plugin through 1.4's settings page or when a visitor loads a page displaying its output.
Internet-facing
14 days
Internal
At next upgrade
- Not known to be exploited
- Needs hands-on effort to exploit
- Gives an attacker full control
Severity
8.8
High
Type
CWE-79Cross-site Scripting (XSS)
Timeline
Published11 Oct 2026
Updated15 Oct 2026
First seen11 Oct 2026
Track software like this
Free during beta