CVE-2025-43774

✕ Withdrawn — historical dataLOWCVSS · not yet scored
—

Liferay Portal is vulnerable to XSS attack through its Style Book theme

A reflected cross-site scripting (XSS) vulnerability in the Liferay Portal 7.4.3.132, and Liferay DXP 2025.Q1.0 through 2025.Q1.17 allows a remote authenticated user to inject JavaScript code via Style Book theme name. This malicious payload is then reflected and executed within the user's browser.

CVSS v3
—
EchelonGraph score
Not yet assessedThis CVE record was withdrawn by its numbering authority, so there is no vulnerability to rate.
EPSS PROB
—
EPSS %ILE
—
KEV
—Not applicable: this CVE ID was withdrawn

Published

September 9, 2025

Last Modified

September 9, 2025

Frequently asked(3)

What is CVE-2025-43774?
CVE-2025-43774 is a rejected CVE ID: its record was withdrawn on September 18, 2025 and no longer describes a vulnerability. Reason given: This CVE ID is rejected. The reported vulnerability was found to be present only in a feature that was under development and protected by a beta feature flag. As a result, the issue was not exploitable in the official or public releases within the specified affected ranges, making this a false positive for officially released versions.
When was the CVE record for CVE-2025-43774 published?
The CVE record for CVE-2025-43774 was published on September 9, 2025. EchelonGraph's copy of the record carries a last-modified date of September 9, 2025; the record at its source may have been updated since.
How do I remediate CVE-2025-43774?
There is nothing to remediate under CVE-2025-43774: it is a rejected (withdrawn) CVE ID and no longer describes a vulnerability.