{"id":"CVE-2026-88905","published":"2026-10-11T07:17:27.493","lastModified":"2026-10-13T20:36:00.850","description":"The KeyWord Collector WordPress plugin through 1.4 does not have any authorisation or nonce check when saving its settings, and does not escape them before output, allowing unauthenticated attackers to store malicious JavaScript that executes when an administrator opens the KeyWord Collector WordPress plugin through 1.4's settings page or when a visitor loads a page displaying its output.","cvssScore":8.8,"cvssSeverity":"HIGH","cvssVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","cwes":["CWE-79"],"vendors":[],"products":[],"references":[{"url":"https://wpscan.com/vulnerability/93503140-af69-4734-bf65-bc781b761c47/","tags":[]}],"exploitRefs":[],"hasPoc":false,"ai":{"summary":"The KeyWord Collector WordPress plugin allows unauthenticated attackers to save malicious JavaScript settings without proper authorization checks or output escaping, enabling stored cross-site scripting (XSS) attacks that can execute when administrators view plugin settings or when visitors load pages with the plugin output.","exploitability":"Exploitation is relatively straightforward as it requires only a single HTTP request to save malicious settings, with no authentication required and minimal preconditions beyond having the plugin installed.","blast_radius":"The impact could be significant as attackers could execute arbitrary JavaScript in the context of administrator sessions, potentially leading to full account takeover or privilege escalation within the WordPress admin environment.","remediation":"Disable the KeyWord Collector plugin immediately or upgrade to version 1.5 which fixes the authorization and output escaping issues.","detection":"No reliable host or network indicator is derivable from the published description.","tags":["xss","wordpress","plugin","unauth"],"model":"garnet-coder","analyzedAt":"2026-10-13T08:55:14.790Z"}}