What is GHSA-88g3-pv3w-5wmr?

GHSA-88g3-pv3w-5wmr is a security advisory published by GitHub Security Advisories with Medium severity. Liferay Portal is vulnerable to XSS attacks via its remote app title field

Which CVE IDs does GHSA-88g3-pv3w-5wmr cover?

GHSA-88g3-pv3w-5wmr covers the following CVE IDs: CVE-2025-43775. Each CVE has its own detail page on EchelonGraph Pulse with the synthesized EG score.

Which products are affected by GHSA-88g3-pv3w-5wmr?

GHSA-88g3-pv3w-5wmr affects 1 product, including: maven/com.liferay:com.liferay.client.extension.web:\u003e= 1.0.71, \u003c 2.0.27.

GHSA-88g3-pv3w-5wmrMedium

Liferay Portal is vulnerable to XSS attacks via its remote app title field

Vendor

GitHub Security Advisories

Published

September 9, 2025

Last Modified

December 20, 2025

🔗 CVE IDs covered (1)

CVE-2025-43775 →

📋 Description

A stored cross-site scripting (XSS) vulnerability in Liferay Portal 7.4.0 through 7.4.3.128, and Liferay DXP 2024.Q3.0 through 2024.Q3.5, 2024.Q2.0 through 2024.Q2.12, 2024.Q1.1 through 2024.Q1.12, and 7.4 GA through update 92 allows remote attackers to inject arbitrary web script or HTML via remote app title field.

🎯 Affected products1

maven/com.liferay:com.liferay.client.extension.web:>= 1.0.71, < 2.0.27

🔗 References (5)

https://nvd.nist.gov/vuln/detail/CVE-2025-43775
https://liferay.dev/portal/security/known-vulnerabilities/-/asset_publisher/jekt/content/CVE-2025-43775
https://github.com/liferay/liferay-portal/commit/e54b2b41564df4f11cfa77b3e6c4353cf0a3b16d
https://liferay.atlassian.net/browse/LPE-18123
https://github.com/advisories/GHSA-88g3-pv3w-5wmr