CVE-2025-43769 MEDIUM

CVE-2025-43769

Vendor Liferay
Product Portal
Weakness CWE-79 · XSS
Published August 23, 2025
Last update August 25, 2025
View on NVD All CVEs

CVSS base score

4.6/10
Attack vector Network
Attack complexity Low
Privileges required High
User interaction —
Confidentiality —
Integrity —

CVSS vector

CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:A/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N

What the vulnerability does

01Description

Stored cross-site scripting (XSS) vulnerability in Liferay Portal 7.4.0 through 7.4.3.131, and Liferay DXP 2024.Q3.1 through 2024.Q3.8, 2024.Q2.0 through 2024.Q2.13, 2024.Q1.1 through 2024.Q1.12 and 7.4 GA through update 92 allows remote attackers to execute arbitrary web script or HTML via components tab.

Key dates

02Disclosure timeline

August 23, 2025 CVE published
August 25, 2025 Record updated

Related vulnerabilities

04Related CVE

CVE-2024-13395 Threepress <= 1.7.1 - Authenticated (Contributor+) Stored Cross-Site Scripting CVE-2023-33961 Leantime Stored Cross-site Scripting Vulnerability CVE-2024-12117 Stackable – Page Builder Gutenberg Blocks <= 3.13.11 - Authenticated (Contributor+) Stored Cross-Site Scripting CVE-2025-69088 WordPress Combo Offers WooCommerce plugin <= 4.2 - Cross Site Scripting (XSS) vulnerability CVE-2025-11829 Five9 Live Chat <= 1.1.2 - Authenticated (Contributor+) Stored Cross-Site Scripting