Stored Cross-Site Scripting in Five9 Live Chat Plugin for WordPress

CVE-2025-11829

What is CVE-2025-11829?

The Five9 Live Chat plugin for WordPress is affected by a Stored Cross-Site Scripting (XSS) vulnerability. This arises from a lack of proper input sanitization and output escaping in the 'toolbar' attribute of the [five9-chat] shortcode. Authenticated attackers with contributor-level access can exploit this flaw, allowing them to inject malicious web scripts into pages, which could execute when users visit the manipulated pages. This presents a significant security risk, as it can lead to unauthorized access to user data and site integrity issues.

References