Five9 Live Chat for WordPress contains a stored cross‑site scripting flaw because the 'toolbar' attribute of the [five9-chat] shortcode is not properly sanitized or escaped. This allows a contributor‑level or higher user to embed JavaScript into the stored content; when a site visitor loads the affected page, the injected script runs in their browser and can steal session data, deface the site, or perform other malicious actions. The weakness is a classic input‑validation problem identified as CWE‑79.

The vulnerability exists in any website running Five9 Live Chat versions 1.1.2 or earlier. Only WordPress installations that include the plugin and have users with Contributor or greater privileges are affected, because only those users can edit content and inject the malicious value.

The CVSS score of 6.4 places the flaw in the moderate range. The EPSS score of less than 1% indicates low probability of active exploitation, and the vulnerability is not listed in CISA’s KEV catalog. Nevertheless, the attack requires authenticated access with contributor‑level rights; after injection, the malicious code remains in the database and executes for every visitor to the stored page.