CVE-2021-38264: com.liferay.frontend.taglib.clay Vulnerable to Cross-Site Scripting (XSS)
Summary
CVE-2021-38264: Liferay Portal vulnerable to cross-site scripting (XSS) via the keywords parameter. Affects com.liferay:com.liferay.frontend.taglib.clay versions < 7.1.15. Fixed in 7.1.15. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The com.liferay.frontend.taglib.clay package is part of the Liferay Portal, a popular open-source platform for building web applications and websites. This package provides a set of frontend tag libraries that facilitate the development of user interfaces with modern design elements. However, it has been found to be susceptible to a cross-site scripting (XSS) vulnerability, which can compromise the security of applications built using this package.
Vulnerability Detail
The vulnerability arises from improper handling of user input in the keywords parameter of the Frontend Taglib module. This flaw allows attackers to inject malicious scripts into web pages viewed by other users, potentially leading to data theft, session hijacking, or other malicious activities. The issue affects Liferay Portal versions 7.4.1 and below, and it is classified under CWE-79, which pertains to improper neutralization of input during web page generation.
How To Fix
Latest published version: 16.0.2 as of 23 Oct 2026
Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
7.1.15
This is the first release that contains the fix.
Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
If immediate updating is not feasible, consider implementing input validation and sanitization on the keywords parameter to mitigate the risk of XSS attacks. Ensure that any user-generated content is properly encoded before rendering it in the web application.
Conclusion
The com.liferay.frontend.taglib.clay package has a significant XSS vulnerability that can impact the security of applications built on Liferay Portal. It is crucial to update to the patched version 7.1.15 or later to mitigate risks associated with this vulnerability.
See every vulnerability recorded for com.liferay:com.liferay.frontend.taglib.clay →
FAQ
CVE-2021-38264 is a cross-site scripting (XSS) vulnerability found in the com.liferay.frontend.taglib.clay package of Liferay Portal.
Liferay Portal versions 7.4.1 and below are affected by this vulnerability.
You can use Vulert, which monitors and alerts for open-source vulnerabilities in your software. You can check your application without signup using the Vulert playground.
The vulnerability can lead to data theft, session hijacking, and other malicious activities due to the injection of harmful scripts.
The CVSS score of this vulnerability is 6.1, indicating a moderate level of severity.
Related vulnerabilities
Recent vulnerabilities recorded for com.liferay:com.liferay.frontend.taglib.clay.
