4 matches found
CVE-2026-88905
The KeyWord Collector WordPress plugin through 1.4 does not have any authorisation or nonce check when saving its settings, and does not escape them before output, allowing unauthenticated attackers to store malicious JavaScript that executes when an administrator opens the KeyWord Collector...
CVE-2026-88905
The KeyWord Collector WordPress plugin, affecting versions through 1.4 , is vulnerable to unauthenticated stored Cross-Site Scripting (XSS) and unauthorized settings updates. The root cause is a lack of authorisation or nonce checks when saving settings via WPKeyWordSettings, combined with a fail...
CVE-2026-88905 KeyWord Collector <= 1.4 - Unauthenticated Stored XSS and Settings Update via WPKeyWordSettings
The KeyWord Collector WordPress plugin through 1.4 does not have any authorisation or nonce check when saving its settings, and does not escape them before output, allowing unauthenticated attackers to store malicious JavaScript that executes when an administrator opens the KeyWord Collector...
EUVD-2026-96777
The KeyWord Collector WordPress plugin through 1.4 does not have any authorisation or nonce check when saving its settings, and does not escape them before output, allowing unauthenticated attackers to store malicious JavaScript that executes when an administrator opens the KeyWord Collector...