The Continually WordPress plugin contains a stored cross‑site scripting flaw that allows authenticated users with administrator privileges or higher to inject arbitrary JavaScript into the "continually_embed_code" setting. When any user views the page containing the injected code, the script executes in that user's browser. This can lead to session hijacking, credential theft, defacement, or the delivery of additional malware to site visitors.

All WordPress installations using Continually plugin version 4.3.1 or earlier are impacted. The flaw is exploitable on multi‑site networks and on regular sites when the WordPress setting unfiltered_html is disabled. It does not affect installations that have unfiltered_html enabled or are running a newer plugin version.

The CVSS score of 4.4 classifies the vulnerability as moderate. Exploitation requires authenticated access with administrator-level credentials. The EPSS score is not available, so no assessment of real‑world exploitation likelihood can be made, and the flaw is not listed in the CISA KEV catalog. Attackers would typically modify the embedded code field through the plugin’s admin interface to inject malicious scripts, which then persist and are served to any visitor who accesses the affected page.