CVE-2025-43823 MEDIUM

CVE-2025-43823

Vendor Liferay
Product Portal
Weakness CWE-79 · XSS
Published October 7, 2025
Last update October 8, 2025
View on NVD All CVEs

CVSS base score

4.8/10
Attack vector Network
Attack complexity Low
Privileges required Low
User interaction —
Confidentiality —
Integrity —

CVSS vector

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:A/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N

What the vulnerability does

01Description

Cross-site scripting (XSS) vulnerability in the Commerce Search Result widget in Liferay Portal 7.4.0 through 7.4.3.111, and Liferay DXP 2023.Q4 before patch 6, 2023.Q3 before patch 9, and 7.4 GA through update 92 allows remote attackers to inject arbitrary web script or HTML via a crafted payload injected into a Commerce Product's Name text field.

Key dates

02Disclosure timeline

October 7, 2025 CVE published
October 8, 2025 Record updated

Related vulnerabilities

04Related CVE

CVE-2025-23552 WordPress Texteller plugin <= 1.3.0 - Reflected Cross Site Scripting (XSS) vulnerability CVE-2022-0186 Image Photo Gallery Final Tiles Grid < 3.5.3 - Contributor+ Stored Cross-Site Scripting CVE-2025-32599 WordPress Task Scheduler Plugin <= 1.6.3 - Reflected Cross Site Scripting (XSS) vulnerability CVE-2024-56261 WordPress Project Showcase plugin <= 1.1.1 - Cross Site Scripting (XSS) vulnerability CVE-2026-32840 Edimax GS-5008PL <= 1.00.54 Stored XSS via Device Name