CVE-2025-43775

Stored cross-site scripting (XSS) vulnerability in Liferay Portal 7.4.0 through 7.4.3.128, and Liferay DXP 2024.Q3.0 through 2024.Q3.5, 2024.Q2.0 through 2024.Q2.12, 2024.Q1.1 through 2024.Q1.12, and 7.4 GA through update 92 allows remote attackers to inject arbitrary web script or HTML via remote app title field.

Published: Sep 9, 2025
Updated: Sep 12, 2025
CVE: CVE-2025-43775
GHSA: GHSA-88g3-pv3w-5wmr
Severity: Medium
Exploit:

No technical information available.

CWEs:

CWE-79

OWASP TOP 10:

A7 - Cross-Site Scripting (XSS)

Affected Software
References

Software	From	Fixed in
com.liferay / com.liferay.client.extension.web	1.0.71	2.0.27

https://github.com/liferay/liferay-portal/commit/e54b2b41564df4f11cfa77b3e6c4353cf0a3b16d
https://liferay.atlassian.net/browse/LPE-18123
https://liferay.dev/portal/security/known-vulnerabilities/-/asset_publisher/jekt/content/CVE-2025-43775

Vulnerability Database

CVE-2025-43775

Deep Security Visibility Without the Complexity