Stored Cross-Site Scripting Vulnerability in Liferay Portal and DXP

CVE-2025-43787

What is CVE-2025-43787?

A stored cross-site scripting vulnerability exists in the Liferay Portal and Liferay DXP that allows remote authenticated attackers to inject malicious JavaScript through organization site names. The payload is stored on the server and executed in users' browsers without proper sanitization, potentially leading to unauthorized actions or data theft. This vulnerability affects multiple versions of Liferay Portal and DXP, emphasizing the need for immediate attention to secure web applications against such threats.

References