Stored Cross-Site Scripting in Liferay Portal and DXP

CVE-2025-43776

What is CVE-2025-43776?

A stored cross-site scripting vulnerability exists in versions of Liferay Portal and DXP, allowing an authenticated attacker to inject malicious JavaScript. The vulnerability arises through the Custom Object field label, where payloads can be stored and subsequently executed within the Process Builder's Configuration tab due to improper escaping. This flaw can lead to unauthorized actions and expose users to potential security risks.

References