Description

Stored cross-site scripting (XSS) vulnerability in the notifications widget in Liferay Portal 7.4.0 through 7.4.3.112, and Liferay DXP 2023.Q4.0 through 2023.Q4.8, 2023.Q3.1 through 2023.Q3.10, and 7.4 GA through update 92 allows remote attackers to inject arbitrary web script or HTML via a crafted payload injected into a publication’s “Name” text field.

Remediation

References

CVE-2025-43807

Related Vulnerabilities

Dot CMS Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Vulnerability (CVE-2020-17542)

WordPress Plugin NextGEN Pro Cross-Site Scripting (3.1.9)

WordPress Plugin Tutor LMS-eLearning and online course solution Cross-Site Request Forgery (2.6.1)

WordPress Plugin Google Doc Embedder Multiple Vulnerabilities (2.6.1)

Atlassian Confluence Incorrect Default Permissions Vulnerability (CVE-2017-9505)

Severity

Medium

Classification

CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

Tags

Missing Update Known Vulnerabilities CWE-707 CVE-2025-43807