CVE-2025-43771CWE-79cross-site-scripting

CVE-2025-43771

Medium · published October 8, 2025

CVSS v3.1
5.4
EPSS
0%
Percentile
10.9
In the wild
Unconfirmed
What it is

Multiple cross-site scripting (XSS) vulnerabilities in the Notifications widget in Liferay Portal 7.4.3.102 through 7.4.3.111, and Liferay DXP 2023.Q4.0 through 2023.Q4.5 and 2023.Q3.1 through 2023.Q3.10 allow remote attackers to inject arbitrary web script or HTML via a crafted payload injected into (1) a user’s “First Name” text field, (2) a user’s “Middle Name” text field, (3) a user’s “Last Name” text field, (4) the “Other Reason” text field when flagging content, or (5) the name of the flagged content.

The record
Technical detail
CVSS v3.1
5.4 · MEDIUM
Vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
CVSS v4.0
Not supplied
EPSS
0.00212 · 10.9th percentile
Weakness
CWE-79 · Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Published
2025-10-08T19:16Z
Affected products (3)
ProductVersionsFixed in
liferay/digital_experience_platform≥ 2023.Q3.1, < 2023.Q3.42023.Q3.4
liferay/digital_experience_platform≥ 2023.q4.0, < 2023.q4.62023.q4.6
liferay/liferay_portal≥ 7.4.3.102, < 7.4.3.1127.4.3.112
References (1)
https://liferay.dev/portal/security/known-vulnerabilities/-/asset_publisher/jekt/content/CVE-2025-43771 · [email protected]
EPSS history
Timeline
  • 08 OCT 14:13Z
    Multiple cross-site scripting (XSS) vulnerabilities in the Notifications widget in Liferay Portal 7.4.3.102 through 7.4.3.111, and Liferay DXP 2023.Q4.0…
    cvelistv5