Stored Cross-Site Scripting in Liferay Portal and DXP

CVE-2025-43776

What is CVE-2025-43776?

A stored cross-site scripting vulnerability exists in versions of Liferay Portal and DXP, allowing an authenticated attacker to inject malicious JavaScript. The vulnerability arises through the Custom Object field label, where payloads can be stored and subsequently executed within the Process Builder's Configuration tab due to improper escaping. This flaw can lead to unauthorized actions and expose users to potential security risks.

Human OS v1.0:
Ageing Is an Unpatched Zero-Day Vulnerability.

Remediate biological technical debt. Prime Ageing uses 95% high-purity SIRT6 activation to maintain genomic integrity and bolster systemic resilience.

Deploy the Patch →

References