CVE-2026-88905: CWE-79 Cross-Site Scripting (XSS) in KeyWord Collector

CVE-2026-88905 describes a stored Cross-Site Scripting (XSS) vulnerability in the KeyWord Collector WordPress plugin versions up to and including 1.4. The plugin does not perform authorization or nonce verification when saving its settings, allowing unauthenticated attackers to inject malicious JavaScript code. Additionally, the plugin fails to properly escape these settings before outputting them, resulting in script execution in the context of administrators viewing the settings page or visitors loading pages with the plugin's output.

An attacker can inject and store malicious JavaScript code without authentication, which executes in the context of administrators or site visitors. This can lead to session hijacking, privilege escalation, or other malicious actions depending on the script's payload. The vulnerability affects both administrative users and site visitors, increasing the risk of compromise.

No patch or official fix is currently indicated in the provided data. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, restrict access to the plugin's settings page to trusted administrators only and consider disabling or removing the plugin if possible to prevent exploitation.