Stored XSS Vulnerabilities in Liferay Portal and Liferay DXP

CVE-2025-43826

What is CVE-2025-43826?

Stored cross-site scripting (XSS) vulnerabilities exist in the Web Content translation feature of Liferay Portal and Liferay DXP, affecting various versions. These vulnerabilities allow remote attackers to exploit any rich text field in web content articles, potentially injecting arbitrary web scripts or HTML. This could lead to unauthorized actions taken on behalf of the victim, data theft, or further compromises of the affected system. Users and administrators are urged to update their installations to mitigate these risks.

References