Cross-Site Scripting Vulnerability in Liferay Portal and DXP

CVE-2025-43800

What is CVE-2025-43800?

A cross-site scripting (XSS) vulnerability exists in Liferay Portal versions 7.4.3.20 to 7.4.3.111 and Liferay DXP from 2023.Q3.1 to 2023.Q4.0, including 7.4 GA up to update 92. This flaw allows remote attackers to craft malicious payloads targeting objects with rich text fields, enabling them to inject arbitrary web scripts or HTML. Successful exploitation could compromise user sessions or redirect users to malicious sites, thereby posing significant risks to web application security.

Human OS v1.0:
Ageing Is an Unpatched Zero-Day Vulnerability.

Remediate biological technical debt. Prime Ageing uses 95% high-purity SIRT6 activation to maintain genomic integrity and bolster systemic resilience.

Deploy the Patch →

References