Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.
5.1

Liferay Portal: Malicious Scripts Can Be Injected via Custom Sort Widget

CVE-2025-43734 · published 1 year ago
Summary

Certain versions of Liferay Portal and DXP allow an authenticated attacker to inject malicious JavaScript code into a configuration field, which can be executed when the page is refreshed. This can lead to unauthorized access to sensitive information or actions. Update to a fixed version to prevent this risk.

What to do
  • Update liferay com.liferay.portal:release.dxp.bom to version 2024.q1.17.
  • Update liferay com.liferay.portal:release.dxp.bom to version 2025.q1.11.
  • Update liferay com.liferay:com.liferay.frontend.taglib.clay to version 15.2.2.
Affected software
Ecosystem VendorProductAffected versions
maven liferay com.liferay.portal:release.portal.bom >= 7.4.0, <= 7.4.3.132
maven liferay com.liferay.portal:release.dxp.bom >= 2024.q4.0, <= 2024.q4.7
>= 2024.q3.0, <= 2024.q3.13
>= 2024.q2.0, <= 2024.q2.13
>= 2024.q1.0, <= 2024.q1.16
>= 2025.q1.0, <= 2025.q1.10
<= 7.4.13.u92
Fix: upgrade to 2024.q1.17
maven liferay com.liferay:com.liferay.frontend.taglib.clay < 15.2.2
Fix: upgrade to 15.2.2
– liferay digital_experience_platform >= 2024.q1.1, <= 2024.q1.16
>= 2024.Q2.1, <= 2024.Q2.13
>= 2024.q3.1, <= 2024.q3.13
>= 2024.q4.0, <= 2024.q4.7
>= 2025.q1.0, <= 2025.q1.10
7.4
cpe:2.3:a:liferay:digital_experience_platform:*:*:*:*:*:*:*:*
– liferay liferay_portal >= 7.4.0, <= 7.4.3.132
cpe:2.3:a:liferay:liferay_portal:*:*:*:*:*:*:*:*
Original advisory text
A reflected cross-site scripting (XSS) vulnerability in the Liferay Portal 7.4.0 through 7.4.3.132, and Liferay DXP 2025.Q1.0 through 2025.Q1.10, 2024.Q4.0 through 2024.Q4.7, 2024.Q3.1 through 2024...
A reflected cross-site scripting (XSS) vulnerability in the Liferay Portal 7.4.0 through 7.4.3.132, and Liferay DXP 2025.Q1.0 through 2025.Q1.10, 2024.Q4.0 through 2024.Q4.7, 2024.Q3.1 through 2024.Q3.13, 2024.Q2.1 through 2024.Q2.13, 2024.Q1.1 through 2024.Q1.16 and 7.4 GA through update 92 allows a remote authenticated attacker to inject JavaScript code in the “first display label” field in the configuration of a custom sort widget. This malicious payload is then reflected and executed by clay button taglib when refreshing the page.
References
Fix within
Internet-facing 60 days
Internal At next upgrade
  • Not known to be exploited
  • Needs hands-on effort to exploit
  • Gives an attacker partial control
Severity
5.1 Medium
Exploitation
<1% chance of attack within 30 days
Type
CWE-79Cross-site Scripting (XSS)
Timeline
Published12 Aug 2025
Updated2 Nov 2026
First seen6 Mar 2026
Sources
GHSA-m5c7-5gv3-hcpf · GHSA
CVE-2025-43734 · NVD
Track software like this
Free during beta