WordPress Plugin Stores Unescaped JavaScript Without Authorization

The KeyWord Collector WordPress plugin through 1.4 does not have any authorisation or nonce check when saving its settings, and does not escape them before output, allowing unauthenticated attackers to store malicious JavaScript that executes when an administrator opens the KeyWord Collector WordPress plugin through 1.4's settings page or when a visitor loads a page displaying its output.

Casky was already ahead

This CVE exploits attack patterns that Casky's 323matched skills already investigate — long before this vulnerability was disclosed. Claude's reasoning model maps these techniques to MITRE ATT&CK, so practitioners who ran these skills have already seen the threat behaviour in their findings.

Analysis

The KeyWord Collector WordPress plugin through version 1.4 contains a critical stored cross-site scripting (XSS) vulnerability stemming from two security failures: complete absence of authorization checks and missing output encoding. Any unauthenticated attacker can inject malicious JavaScript into the plugin's settings, which then executes in the browsers of administrators accessing the settings page or any website visitor viewing pages displaying the plugin's output. This affects all WordPress installations using the vulnerable plugin version, particularly those with public-facing pages leveraging KeyWord Collector's functionality. With a CVSS score of 8.8, this vulnerability enables account takeover of administrative users, malware distribution, and site-wide compromise through a relatively simple exploitation path requiring no special tools or authentication.

Casky's 323 matching security skills leverage Claude AI's reasoning to detect the exploitation patterns mapped to MITRE ATT&CK techniques TA0001 (Initial Access) and TA0043 (Reconnaissance). Practitioners would observe detection findings showing: unauthorized parameter modification attempts targeting plugin settings endpoints (improper access control pattern), suspicious JavaScript injection payloads in HTTP requests (CWE-79 indicators), and subsequent execution contexts in administrator browsers or visitor sessions (DOM-based attack chains). Claude's extended reasoning capabilities correlate the missing nonce validation with the absence of capability checks, identifying this as a composite vulnerability pattern. Security teams would see findings highlighting both the injection vector and persistence mechanism—specifically how unauthenticated POST requests successfully alter stored data without session validation, then how that data executes client-side without HTML encoding, creating a complete attack chain from initial access through persistent payload delivery.

Live Threat IntelligenceComing soon

Casky Risk Score

—

EPSS Probability

—

Shodan Exposure

—

GreyNoise Signal

—

Composite risk scoring from EPSS, CISA KEV, Shodan, and GreyNoise — 21 security APIs correlated into a single Casky Risk Score. Coming in Casky Pro. Join early access →

323 Casky skills cover this attack pattern

These skills use Claude AI's reasoning model to surface findings in the same attack categories as CVE-2026-88905.

Abuse of Public-Facing API: Mobile API Abuse

mobile security · low

Run

abusing-dpapi-for-credential-access

red teaming · high

Run

abusing-shadow-credentials-for-privesc

red teaming · high

Run

MITRE ATT&CK Techniques

TA0001 TA0043

Investigate the attack patterns behind CVE-2026-88905

Casky has 323 skills that investigate the attack patterns behind CVE-2026-88905. Run one and get CVSS-scored findings in 3 minutes.

Run the skill that detects this →

X Instagram LinkedIn