CVE-2026-88905 KeyWord Collector CVE debrief

Who should care

Defenders responsible for WordPress installations, particularly those using the KeyWord Collector plugin, should assess exposure and prioritize verification and potential remediation.

Why it matters

The KeyWord Collector WordPress plugin vulnerability allows unauthenticated attackers to store malicious JavaScript, potentially leading to security issues. Defenders should prioritize verifying exposure and assessing the security of their WordPress installations.

• Potential execution of malicious JavaScript on the settings page or when a visitor loads a page displaying the output
• Possible unauthorized storage of malicious JavaScript
• Required verification of WordPress installation security and plugin version

Technical summary

The KeyWord Collector WordPress plugin through 1.4 does not have any authorisation or nonce check when saving its settings, and does not escape them before output, allowing unauthenticated attackers to store malicious JavaScript that executes when an administrator opens the KeyWord Collector WordPress plugin through 1.4's settings page or when a visitor loads a page displaying its output. Defenders should prioritize verifying exposure of the KeyWord Collector WordPress plugin version 1.4 or earlier and assess the security of their WordPress installations.

Defensive priority

Defenders should prioritize verifying exposure of the KeyWord Collector WordPress plugin version 1.4 or earlier and assess the security of their WordPress installations.

Recommended defensive actions

• Verify the version of the KeyWord Collector WordPress plugin and upgrade to a patched version if necessary
• Assess the security of WordPress installations and ensure proper authorization and nonce checks are in place
• Monitor for potential malicious JavaScript execution
• Review compensating controls for exposed systems while remediation is scheduled and verified
• Check relevant monitoring, detection, and logs for exposed assets that need extra review
• Track exceptions, retest remediated assets, and close the item only after evidence is documented
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up

Evidence notes

The CVE record and NVD entry provide limited information about the vulnerability. Further verification is required to determine the affected versions and potential impact. Defenders should verify the security of WordPress installations using the KeyWord Collector plugin version 1.4 or earlier and assess potential exposure to malicious JavaScript storage and execution.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.