José Ricardo

**Name of the Vulnerable Software and Affected Versions** Liferay Portal versions 7.4.0 through 7.4.3.132 Liferay DXP versions 2025.Q1.0 through 2025.Q1.5 Liferay DXP versions 2024.Q4.0 through 2024.Q4.7 Liferay DXP versions 2024.Q3.1 through 2024.Q3.13 Liferay DXP versions 2024.Q2.0 through 2024.Q2.13 Liferay DXP versions 2024.Q1.1 through 2024.Q1.15 Liferay Portal 7.4 GA through update 92 **Description** The issue is a Server-Side Request Forgery (SSRF) vulnerability in FreeMarker templates. It allows template editors to bypass access validations through crafted URLs. **Recommendations** Update Liferay Portal to a version later than 7.4.3.132. Update Liferay DXP to a version later than 2025.Q1.5. Update Liferay DXP to a version later than 2024.Q4.7. Update Liferay DXP to a version later than 2024.Q3.13. Update Liferay DXP to a version later than 2024.Q2.13. Update Liferay DXP to a version later than 2024.Q1.15. Update Liferay Portal to a version later than update 92.

**Name of the Vulnerable Software and Affected Versions** The Rock Convert WordPress plugin versions prior to 2.11.0 **Description** The issue is related to a Reflected Cross-Site Scripting problem. It occurs when a specific widget is present on a page and an URL is not properly sanitised and escaped before being outputted back in an attribute. **Recommendations** For versions prior to 2.11.0, update to version 2.11.0 or later to resolve the issue.

**Name of the Vulnerable Software and Affected Versions** The Rock Convert WordPress plugin versions prior to 2.11.0 **Description** The issue allows high privilege users, such as admins, to perform Stored Cross-Site Scripting attacks. This is possible because some settings are not properly sanitised and escaped, and this vulnerability can be exploited even when the unfiltered html capability is disallowed, for example in a multisite setup. **Recommendations** For versions prior to 2.11.0, update to version 2.11.0 or later to resolve the issue. As a temporary workaround, consider restricting the ability of high privilege users to access and modify the plugin's settings until the update can be applied.