CVE-2025-43800 — Cross-site Scripting in Digital Experience Platform

CWE-79 — Cross-site Scripting5 documents5 sources
Severity
4.8MEDIUMNVD
EPSS
0.0%
top 90.92%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
4
Liferay Digital Experience PlatformLiferay PortalLiferay DXP+1 more
Timeline
PublishedSep 15

Description

Cross-site scripting (XSS) vulnerability in Objects in Liferay Portal 7.4.3.20 through 7.4.3.111, and Liferay DXP 2023.Q4.0, 2023.Q3.1 through 2023.Q3.4 and 7.4 GA through update 92 allows remote attackers to inject arbitrary web script or HTML via a crafted payload injected into an object with a rich text type field.

CVSS vector

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:A/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N

Affected Packages4 packages

▶NVDliferay/liferay_portal7.4.3.20 — 7.4.3.112
▶CVEListV5liferay/portal7.4.3.20 — 7.4.3.111
▶NVDliferay/digital_experience_platform2023.q3.1 — 2023.q3.5+2
▶CVEListV5liferay/dxp7.4.13-u20 — 7.4.13-u92+2

🔴Vulnerability Details

3
GHSA
Liferay Portal Cross-site Scripting (XSS) vulnerability↗2025-09-15
▶
OSV
Liferay Portal Cross-site Scripting (XSS) vulnerability↗2025-09-15
▶
CVEList
CVE-2025-43800: Cross-site scripting (XSS) vulnerability in Objects in Liferay Portal 7↗2025-09-15
▶

📋Vendor Advisories

1
Microsoft
serve-static affected by template injection that can lead to XSS↗2024-09-10
▶
CVE-2025-43800 — Cross-site Scripting | cvebase