CVE-2026-88905

Summary

The KeyWord Collector WordPress plugin allows unauthenticated attackers to save malicious JavaScript settings without proper authorization checks or output escaping, enabling stored cross-site scripting (XSS) attacks that can execute when administrators view plugin settings or when visitors load pages with the plugin output.

Exploitability

Exploitation is relatively straightforward as it requires only a single HTTP request to save malicious settings, with no authentication required and minimal preconditions beyond having the plugin installed.

Blast radius

The impact could be significant as attackers could execute arbitrary JavaScript in the context of administrator sessions, potentially leading to full account takeover or privilege escalation within the WordPress admin environment.

Detection

No reliable host or network indicator is derivable from the published description.

Prioritized remediation

Disable the KeyWord Collector plugin immediately or upgrade to version 1.5 which fixes the authorization and output escaping issues.

Analysis generated locally by garnet-coder (no data left the box). AI-assisted — verify against primary sources before acting.