Executive brief
The Continually plugin for WordPress, which is used to integrate lead generation and chatbot services, contains a security flaw in its administrative settings. This vulnerability allows an authorized administrator to save malicious scripts that will run when other users visit the site. This issue primarily impacts WordPress multi-site environments or specific configurations where standard security restrictions on HTML content have been disabled.
Technical details
The Continually plugin for WordPress is vulnerable to Stored Cross-Site Scripting (XSS) due to insufficient input sanitization and output escaping in the administrative settings. An authenticated attacker with administrator-level permissions can inject arbitrary web scripts into the database. These scripts then execute in the browser of any user accessing the affected pages. This vulnerability specifically impacts WordPress multi-site installations and environments where the 'unfiltered_html' capability has been disabled for administrators. The flaw exists in versions up to and including 4.3.1.
Affected products
- Continually Continually Up to, and including, 4.3.1
Timeline
- 2026-05-12: disclosed
- 2026-05-12: advisory
References
- https://plugins.trac.wordpress.org/browser/continually/tags/4.3.1/admin/class-continually-admin.php
- https://plugins.trac.wordpress.org/browser/continually/tags/4.3.1/public/class-continually-public.php
- https://plugins.trac.wordpress.org/browser/continually/trunk/admin/class-continually-admin.php
- https://plugins.trac.wordpress.org/browser/continually/trunk/public/class-continually-public.php
- https://www.wordfence.com/threat-intel/vulnerabilities/id/d0e6900c-21a3-4b46-bb61-8c41e2234a26?source=cve