CVE-2025-43774: XSS Vulnerability in com.liferay.frontend.taglib.clay Package
Summary
CVE-2025-43774: Liferay Portal is vulnerable to XSS attack through its Style Book theme. Affects com.liferay:com.liferay.frontend.taglib.clay versions < 15.2.1. Fixed in 15.2.1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The com.liferay.frontend.taglib.clay package is part of the Liferay Portal, a popular open-source platform for building web applications and websites. This package provides various frontend components and functionalities, enhancing the user interface and user experience. However, it is susceptible to a reflected cross-site scripting (XSS) vulnerability, which can be exploited by malicious users to inject harmful scripts into web pages.
Vulnerability Detail
A reflected cross-site scripting (XSS) vulnerability exists in Liferay Portal versions 7.4.3.132 and Liferay DXP 2025.Q1.0 through 2025.Q1.17. This vulnerability allows a remote authenticated user to inject JavaScript code via the Style Book theme name. When this malicious payload is submitted, it is reflected back and executed in the browser of any user accessing the affected page, potentially leading to unauthorized actions, data theft, or session hijacking.
How To Fix
Latest published version: 16.0.2 as of 23 Oct 2026
Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
15.2.1
This is the first release that contains the fix.
Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, you can restrict access to the Style Book theme name functionality to trusted users only, minimizing the risk of exploitation until the package is updated.
Conclusion
The CVE-2025-43774 vulnerability in the com.liferay.frontend.taglib.clay package poses a significant risk due to its potential for XSS attacks. It is crucial to update to version 15.2.1 or later to mitigate this risk. Additionally, using tools like Vulert can help monitor and manage vulnerabilities effectively.
See every vulnerability recorded for com.liferay:com.liferay.frontend.taglib.clay →
FAQ
CVE-2025-43774 is a vulnerability identifier for a reflected XSS vulnerability found in the com.liferay.frontend.taglib.clay package of Liferay Portal.
If exploited, this vulnerability can allow attackers to inject malicious scripts into your application, potentially leading to data theft, unauthorized actions, or session hijacking.
The vulnerability affects Liferay Portal version 7.4.3.132 and Liferay DXP versions 2025.Q1.0 through 2025.Q1.17.
You can check if your application is affected by using Vulert, which monitors and alerts for open-source vulnerabilities in real-time. You can use the Vulert playground at Vulert Scanner without any signup.
If immediate updates are not possible, consider implementing access restrictions to the affected functionality as a temporary workaround.
References
Related vulnerabilities
Recent vulnerabilities recorded for com.liferay:com.liferay.frontend.taglib.clay.
