CVE-2025-43734 — Cross-site Scripting in DXP

CWE-79 — Cross-site Scripting4 documents4 sources

Severity

5.1MEDIUMNVD

EPSS

0.0%

top 90.50%

CISA KEV

Not in KEV

Exploit

No known exploits

Affected products

Liferay DXP Liferay Portal Liferay Digital Experience Platform +1 more

Timeline

PublishedAug 12

Description

A reflected cross-site scripting (XSS) vulnerability in the Liferay Portal 7.4.0 through 7.4.3.132, and Liferay DXP 2025.Q1.0 through 2025.Q1.10, 2024.Q4.0 through 2024.Q4.7, 2024.Q3.1 through 2024.Q3.13, 2024.Q2.1 through 2024.Q2.13, 2024.Q1.1 through 2024.Q1.16 and 7.4 GA through update 92 allows a remote authenticated attacker to inject JavaScript code in the “first display label” field in the configuration of a custom sort widget. This malicious payload is then reflected and executed by clay…

CVSS vector

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:L/VI:N/VA:N/SC:L/SI:N/SA:N

Affected Packages4 packages

▶CVEListV5liferay/portal7.4.3.0 — 7.4.3.132

▶NVDliferay/liferay_portal7.4.0 — 7.4.3.132

▶CVEListV5liferay/dxp7.4.13 — 7.4.13-u92+5

▶NVDliferay/digital_experience_platform2024.q1.1 — 2024.q1.16+5

🔴Vulnerability Details

GHSA

Liferay Portal 7.4.0 and Liferay DXP have a reflected cross-site scripting (XSS) vulnerability↗2025-08-12

▶

CVEList

CVE-2025-43734: A reflected cross-site scripting (XSS) vulnerability in the Liferay Portal 7↗2025-08-12

▶

OSV

Liferay Portal 7.4.0 and Liferay DXP have a reflected cross-site scripting (XSS) vulnerability↗2025-08-12

▶