CVE-2026-88905

Name of the Vulnerable Software and Affected Versions KeyWord Collector versions prior to 1.5

Description Lack of authorization and nonce checks when saving settings allows unauthenticated attackers to perform a stored Cross-Site Scripting (XSS) attack. This occurs because the plugin fails to escape settings before output, enabling the storage of malicious JavaScript. The script executes when an administrator accesses the settings page or when a visitor loads a page displaying the plugin output. The issue is associated with the WPKeyWordSettings component.

Recommendations Update KeyWord Collector to a version newer than 1.4.