CVE-2025-43830

Name of the Vulnerable Software and Affected Versions Liferay Portal versions 7.3.2 through 7.4.3.111 Liferay DXP versions 2023.Q3.1 through 2023.Q4.5

Description A stored cross-site scripting (XSS) issue exists in Forms within the software. This allows remote attackers to inject arbitrary web script or HTML through a crafted payload. The payload is injected into a form that uses a rich text type field.

Recommendations Update Liferay Portal to a version later than 7.4.3.111. Update Liferay DXP to a version later than 2023.Q4.5. Update Liferay DXP to a version later than 2023.Q3.8. Update Liferay Portal to a version later than 7.3.35. Update Liferay Portal to a version later than 7.4.92.