CVE-2026-88905: KeyWord Collector 0 through 1.4

Affected technology

KeyWord Collector · 0 through 1.4
Vendor not specified by the source

Description’s affected range: through 1.4 does not have any authorisation or nonce check when saving its settings

Component: Not specified by the source

Attack conditions (Source advisory, CVSS 3.1): Network (remote) · No privileges required · User interaction required

What an attacker can do

The source says the KeyWord Collector WordPress plugin through 1.4 does not have any authorisation or nonce check when saving its settings, and does not escape them before output, allowing unauthenticated attackers to store malicious JavaScript that executes when an administrator opens the KeyWord Collector WordPress plugin through 1.4's settings page or when a visitor loads a page displaying its output. Source advisory’s CVSS 3.1 assessment (base score 8.8/10) rates confidentiality, integrity and availability impact as high.