CVE-2025-43731 - A reflected cross-site scripting (XSS) vulnerability in the Liferay Portal 7.4.0 through 7.4.3.132, and Liferay DXP 2025.Q1.0 through 2025.Q1.8, 2024.Q4.0 through 2024.Q4.7, 2024.Q3.1 through 2024.Q3.13, 2024.Q2.0 through 2024.Q2.13, 2024.Q1.1 through 2024.Q1.16 and 7.4 GA through update 92 allows an remote authenticated user to inject JavaScript in message board threads and categories

Back Back to CVE browser

MEDIUM

A reflected cross-site scripting (XSS) vulnerability in the Liferay Portal 7.4.0 through 7.4.3.132, and Liferay DXP 2025.Q1.0 through 2025.Q1.8, 2024.Q4.0 through 2024.Q4.7, 2024.Q3.1 through 2024.Q3.13, 2024.Q2.0 through 2024.Q2.13, 2024.Q1.1 through 2024.Q1.16 and 7.4 GA through update 92 allows an remote authenticated user to inject JavaScript in message board threads and categories

Published Aug 18, 2025

6.9

MEDIUM

CVSS 4.0

EPSS 0.22%

Description

A reflected cross-site scripting (XSS) vulnerability in the Liferay Portal 7.4.0 through 7.4.3.132, and Liferay DXP 2025.Q1.0 through 2025.Q1.8, 2024.Q4.0 through 2024.Q4.7, 2024.Q3.1 through 2024.Q3.13, 2024.Q2.0 through 2024.Q2.13, 2024.Q1.1 through 2024.Q1.16 and 7.4 GA through update 92 allows an remote authenticated user to inject JavaScript in message board threads and categories.

Affected products

Vendor Liferay Product DXP Default
unaffected
- Version
  2024.Q1.1
  Status
  affected
  Constraints
  <=2024.Q1.16
- Version
  2024.Q3.1
  Status
  affected
  Constraints
  <=2024.Q3.13
- Version
  2024.Q4.0
  Status
  affected
  Constraints
  <=2024.Q4.7
- Version
  2024Q2.0
  Status
  affected
  Constraints
  <=2023.Q2.13
- Version
  2025.Q1.0
  Status
  affected
  Constraints
  <=2025.Q1.8
- Version
  7.4.13
  Status
  affected
  Constraints
  <=7.4.13-u92
Vendor Liferay Product Portal Default
unaffected
- Version
  7.4.0
  Status
  affected
  Constraints
  <=7.4.3.132

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor

Product

Default status

Versions

Liferay

DXP

unaffected

Version	Status	Constraints
2024.Q1.1	affected	<=2024.Q1.16
2024.Q3.1	affected	<=2024.Q3.13
2024.Q4.0	affected	<=2024.Q4.7
2024Q2.0	affected	<=2023.Q2.13
2025.Q1.0	affected	<=2025.Q1.8
7.4.13	affected	<=7.4.13-u92

Liferay

Portal

unaffected

Version	Status	Constraints
7.4.0	affected	<=7.4.3.132

Remediation

No remediation recorded yet.

Weaknesses (1)

CWE-79

Cross-site Scripting (XSS)

References (8)

Link	Providers	Tags
https://github.com/advisories/GHSA-3p2m-574v-v257		Advisory
https://github.com/liferay/liferay-portal/commit/41708aa542c103521427ecf06f4b20cb37c65ecf
https://github.com/liferay/liferay-portal/commit/cd1c692dfed3bbebe10074ecb89c561893fffaf9
https://github.com/liferay/liferay-portal/commit/f23921fc93cf713f27ed9c4d31b8c1854c0e2abb
https://liferay.atlassian.net/browse/LPE-18217
https://liferay.atlassian.net/browse/LPE-18219
https://liferay.dev/portal/security/known-vulnerabilities/-/asset_publisher/jekt/content/CVE-2025-43731		Vendor Advisory
https://nvd.nist.gov/vuln/detail/CVE-2025-43731