Cross-Site Scripting Vulnerability in Liferay Portal and DXP

CVE-2025-43800

What is CVE-2025-43800?

A cross-site scripting (XSS) vulnerability exists in Liferay Portal versions 7.4.3.20 to 7.4.3.111 and Liferay DXP from 2023.Q3.1 to 2023.Q4.0, including 7.4 GA up to update 92. This flaw allows remote attackers to craft malicious payloads targeting objects with rich text fields, enabling them to inject arbitrary web scripts or HTML. Successful exploitation could compromise user sessions or redirect users to malicious sites, thereby posing significant risks to web application security.

References