Stored Cross-Site Scripting Vulnerabilities in Liferay Portal and DXP

CVE-2025-62246

What is CVE-2025-62246?

Multiple stored cross-site scripting (XSS) vulnerabilities exist in various versions of Liferay Portal and Liferay DXP. These vulnerabilities can be exploited by remote authenticated users, enabling them to inject arbitrary web scripts or HTML through crafted payloads inserted into user fields such as first, middle, or last names. The affected integration points include page comments, blog entry comments, document media comments, message board messages, and wiki page comments, among others. This issue underscores the importance of secure input validation to prevent malicious scripts from executing in the web application.

References