Reflected Cross-Site Scripting Vulnerability in Liferay Portal and DXP Products

CVE-2025-62264

What is CVE-2025-62264?

A reflected cross-site scripting (XSS) vulnerability exists in the Language Override feature of Liferay Portal and Liferay DXP. This issue arises from improper validation of the _com_liferay_portal_language_override_web_internal_portlet_PLOPortlet_selectedLanguageId parameter, allowing remote attackers to inject arbitrary web scripts or HTML. Exploiting this vulnerability may enable attackers to execute malicious scripts in the context of the affected user's session, potentially leading to data theft or unauthorized actions.

References