KeyWord Collector WordPress plugin: Unauthenticated stored XSS via settings
Summary
The KeyWord Collector WordPress plugin through version 1.4 does not check authorisation or nonces when saving its settings, and does not escape them on output. An unauthenticated attacker can store malicious JavaScript that runs when an administrator opens the plugin settings page or when a visitor loads a page displaying the plugin output. The attack requires user interaction, and the CVSS base score is 8.8.
Affected
- KeyWord Collector WordPress plugin, all versions up to and including 1.4
Fixed in
- Unknown. No fixed version is known; WPScan lists "No known fix".
Workaround
- No vendor workaround known.
- Deactivate and remove the plugin if it is not required.
- Review the stored plugin settings for unexpected script content.
- Restrict administrator logins to trusted networks.
Exploitation
- No exploitation in the wild known.
- Not listed in CISA KEV; CISA SSVC marks exploitation as none and automatable as no.
- Public proof of concept: unverified.
- EPSS about 0.17%.
Our recommendation
- Check whether any site uses the KeyWord Collector plugin, including version 1.4 or older.
- Deactivate and remove the plugin on sites that do not need it.
- If it must stay, review the stored settings for injected script and restrict administrator access.
- Monitor the WordPress.org plugin page and the vendor for an update and apply it once available.
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- WPScan: KeyWord Collector <= 1.4 - Unauthenticated Stored XSS wpscan.com
- VulDB: CVE-2026-88905 vuldb.com
- OpenCVE: CVE-2026-88905 app.opencve.io
- Vulners VulnRichment: CVE-2026-88905 vulners.com
- WordPress.org plugin listing: KeyWord Collector wordpress.com
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 31 Oct 2026, 20:37.
Original description (NVD)
The KeyWord Collector WordPress plugin through 1.4 does not have any authorisation or nonce check when saving its settings, and does not escape them before output, allowing unauthenticated attackers to store malicious JavaScript that executes when an administrator opens the KeyWord Collector WordPress plugin through 1.4's settings page or when a visitor loads a page displaying its output.
NVD references (1)
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.