CVE-2025-62239 MEDIUM

CVE-2025-62239

Vendor Liferay
Product Portal
Weakness CWE-79 · XSS
Published October 10, 2025
Last update October 10, 2025
View on NVD All CVEs

CVSS base score

4.6/10
Attack vector Network
Attack complexity Low
Privileges required High
User interaction —
Confidentiality —
Integrity —

CVSS vector

CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:A/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N

What the vulnerability does

01Description

Cross-site scripting (XSS) vulnerability in workflow process builder in Liferay Portal 7.4.3.21 through 7.4.3.111, and Liferay DXP 2023.Q4.0 through 2023.Q4.5, 2023.Q3.1 through 2023.Q3.8, and 7.4 update 21 through update 92 allows remote authenticated attackers to inject arbitrary web script or HTML via the crafted input in a workflow definition.

Key dates

02Disclosure timeline

October 10, 2025 CVE published
October 10, 2025 Record updated

Related vulnerabilities

04Related CVE

CVE-2025-5092 Multiple Plugins and Themes <= (Various Versions) - Authenticated (Contributor+) DOM-Based Stored Cross-Site Scripting via lightGallery JavaScript Library CVE-2025-47828 CVE-2021-1154 Cisco Small Business RV110W, RV130, RV130W, and RV215W Routers Management Interface Stored Cross-Site Scripting Vulnerabilities CVE-2023-45837 WordPress Ultimate Taxonomy Manager Plugin <= 2.0 is vulnerable to Cross Site Scripting (XSS) CVE-2024-11748 Taeggie Feed <= 0.1.9 - Authenticated (Contributor+) Stored Cross-Site Scripting