WordPress Plugin Vulnerabilities

KeyWord Collector <= 1.4 - Unauthenticated Stored XSS and Settings Update via WPKeyWordSettings

Description

The plugin does not have any authorisation or nonce check when saving its settings, and does not escape them before output, allowing unauthenticated attackers to store malicious JavaScript that executes when an administrator opens the plugin's settings page or when a visitor loads a page displaying its output.

Proof of Concept

Affects Plugins

Plugin icon
keyword-collector
No known fix

References

CVE
CVE-2026-88905

Classification

Type
XSS
OWASP top 10
A7: Cross-Site Scripting (XSS)
CWE
CWE-79
CVSS
8.8 (high)

Miscellaneous

Original Researcher
Enrico Marcolini - Claudio Marchesini - Dottor Marc
Submitter
Enrico Marcolini - Claudio Marchesini - Dottor Marc
Submitter website
https://www.dottormarc.it
Verified
Yes
WPVDB ID
93503140-af69-4734-bf65-bc781b761c47

Timeline

Publicly Published
2026-10-09 (about 2 days ago)
Added
2026-10-09 (about 1 day ago)
Last Updated
2026-10-09 (about 1 day ago)

Other

Published
Title
Published
2025-01-16
Title
yCyclista <= 1.2.3 - Reflected Cross-Site Scripting
Published
2026-10-06
Title
Social Share Icons & Social Share Buttons <= 3.7.5 - Unauthenticated Stored Cross-Site Scripting
Published
2026-04-07
Title
WP Visitor Statistics (Real Time Traffic) < 8.5 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'height' Shortcode Attribute
Published
2023-05-11
Title
Pinterest RSS Widget <= 2.3.1 - Contributor+ Stored Cross-Site Scripting via shortcode
Published
2025-08-25
Title
Tripadvisor Shortcode <= 2.2 - Authenticated (Administrator+) Stored Cross-Site Scripting