CVE WATCH / VULNERABILITY DETAIL
CVE-2026-88905
HIGHCVSS 8.8NVD feed
Published 11 October 2026 · tracked since 12 October 2026
Description
The KeyWord Collector WordPress plugin through 1.4 does not have any authorisation or nonce check when saving its settings, and does not escape them before output, allowing unauthenticated attackers to store malicious JavaScript that executes when an administrator opens the KeyWord Collector WordPre
References
- NVD — National Vulnerability Database
- CVE.org record (MITRE)
- CISA Known Exploited Vulnerabilities catalog
Latest tracked vulnerabilities
- CVE-2026-108753 CRITICAL 9.4
- CVE-2026-96227 HIGH 8.8
- CVE-2026-89232 HIGH 8.6
- CVE-2026-89234 HIGH 8.6
- CVE-2026-89283 HIGH 8.6
- CVE-2026-89285 HIGH 8.6
- CVE-2026-89287 HIGH 8.6
- CVE-2026-89297 HIGH 8.6
- CVE-2026-88826 HIGH 8.8
- CVE-2026-88827 HIGH 8.8