CVE-2023-42628 — Stored cross-site scripting (XSS) vulnerability in the Wiki widget in Liferay Portal 7.1.0 through 7.4.3.87, and Liferay DXP 7.0 fix pack 83 through 102, 7.1 fix pack 28 and earlier, 7.2 fix pack 20 and earlier, 7.3 update 33 and earlier, and 7.4 before update 88 allows remote attackers to inject arbitrary web script or HTML into a parent wiki page via a crafted payload injected into a wiki page's ‘Content’ text field

Back Back to CVE browser

CRITICAL

Stored cross-site scripting (XSS) vulnerability in the Wiki widget in Liferay Portal 7.1.0 through 7.4.3.87, and Liferay DXP 7.0 fix pack 83 through 102, 7.1 fix pack 28 and earlier, 7.2 fix pack 20 and earlier, 7.3 update 33 and earlier, and 7.4 before update 88 allows remote attackers to inject arbitrary web script or HTML into a parent wiki page via a crafted payload injected into a wiki page's ‘Content’ text field

Published Oct 17, 2023

9.0

CRITICAL

CVSS 3.1

EPSS 2.24%

Description

Stored cross-site scripting (XSS) vulnerability in the Wiki widget in Liferay Portal 7.1.0 through 7.4.3.87, and Liferay DXP 7.0 fix pack 83 through 102, 7.1 fix pack 28 and earlier, 7.2 fix pack 20 and earlier, 7.3 update 33 and earlier, and 7.4 before update 88 allows remote attackers to inject arbitrary web script or HTML into a parent wiki page via a crafted payload injected into a wiki page's ‘Content’ text field.

Affected products

Vendor Liferay Product DXP Default
unaffected
- Version
  7.0.10-de-83
  Status
  affected
  Constraints
  <=7.0.10-*
- Version
  7.1.10
  Status
  affected
  Constraints
  <=7.1.10-*
- Version
  7.2.10
  Status
  affected
  Constraints
  <=7.2.10-*
- Version
  7.3.10
  Status
  affected
  Constraints
  <=7.3.10-*
- Version
  7.4.13
  Status
  affected
  Constraints
  <=7.4.13.u87
Vendor Liferay Product Portal Default
unaffected
- Version
  7.1.0
  Status
  affected
  Constraints
  <=7.4.3.87

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor

Product

Default status

Versions

Liferay

DXP

unaffected

Version	Status	Constraints
7.0.10-de-83	affected	<=7.0.10-*
7.1.10	affected	<=7.1.10-*
7.2.10	affected	<=7.2.10-*
7.3.10	affected	<=7.3.10-*
7.4.13	affected	<=7.4.13.u87

Liferay

Portal

unaffected

Version	Status	Constraints
7.1.0	affected	<=7.4.3.87

Remediation

No remediation recorded yet.

Metrics

2.24% 0.02239

Estimated probability of exploitation in the wild in the next 30 days (FIRST EPSS). As of Oct 1, 2026.

EPSS probability 0.02239

Score over time

2023–2026

EPSS v3
EPSS v4
EPSS v5

Percentile over time

EPSS v3
EPSS v4
EPSS v5

Table of values (7 key points)

Flat stretches are collapsed; showing up to 120 newest points.

Date	Score	Percentile	Model
Oct 1, 2026	2.24% (0.02239)	82.21th	v5 (v2026.06.15)
Jun 15, 2026	2.24% (0.02239)	80.47th	v5 (v2026.06.15)
Mar 17, 2025	0.33% (0.00326)	53.34th	v4 (v2025.03.14)
Dec 12, 2024	0.07% (0.00069)	32.32th	v3 (v2023.03.01)
May 22, 2024	0.05% (0.00052)	19.99th	v3 (v2023.03.01)
Dec 29, 2023	0.05% (0.00052)	17.96th	v3 (v2023.03.01)
Oct 18, 2023	0.05% (0.00047)	14.41th	v3 (v2023.03.01)

Weaknesses (1)

CWE-79

Cross-site Scripting (XSS)

References (4)

https://github.com/advisories/GHSA-hv45-r2f5-fmhj
Advisory
https://liferay.dev/portal/security/known-vulnerabilities/-/asset_publisher/jekt/content/cve-2023-42628
vendor-advisoryVendor Advisory
https://nvd.nist.gov/vuln/detail/CVE-2023-42628
https://www.pentagrid.ch/en/blog/stored-cross-site-scripting-vulnerabilities-in-liferay-portal
third-party-advisoryexploitThird Party Advisory

Link	Providers	Tags
https://github.com/advisories/GHSA-hv45-r2f5-fmhj		Advisory
https://liferay.dev/portal/security/known-vulnerabilities/-/asset_publisher/jekt/content/cve-2023-42628		vendor-advisoryVendor Advisory
https://nvd.nist.gov/vuln/detail/CVE-2023-42628
https://www.pentagrid.ch/en/blog/stored-cross-site-scripting-vulnerabilities-in-liferay-portal		third-party-advisoryexploitThird Party Advisory