GHSA-jh9h-8xf2-25wjMedium

Liferay has a stored cross-site scripting (XSS) vulnerability via a a publication’s “Name” text field

Published
September 22, 2025
Last Modified
December 16, 2025

🔗 CVE IDs covered (1)

CVE-2025-43807 →

📋 Description

Stored cross-site scripting (XSS) vulnerability in the notifications widget in Liferay Portal 7.4.0 through 7.4.3.112, and Liferay DXP 2023.Q4.0 through 2023.Q4.8, 2023.Q3.1 through 2023.Q3.10, and 7.4 GA through update 92 allows remote attackers to inject arbitrary web scripts or HTML via a crafted payload injected into a publication’s “Name” text field.

🎯 Affected products1

  • maven/com.liferay:com.liferay.change.tracking.service:< 3.0.91

🔗 References (5)