CVE-2025-43821: XSS Vulnerability in Liferay Commerce Product Service
Summary
CVE-2025-43821: Liferay Portal is vulnerable to XXS through its Commerce Product's Name text field. Affects com.liferay.commerce:com.liferay.commerce.product.service versions >= 6.0.5, < 6.0.134. Fixed in 6.0.134. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The Liferay Commerce Product Service is a component of the Liferay Portal, which is a popular open-source platform for building web applications and managing content. This service allows users to manage product information, including product names, descriptions, and comparisons. However, it has been found to be vulnerable to a cross-site scripting (XSS) attack, which can compromise the security of web applications using this service.
Vulnerability Detail
The vulnerability arises from improper handling of user input in the Commerce Product Comparison Table widget. Specifically, the vulnerability allows remote attackers to inject arbitrary web scripts or HTML into the application via a crafted payload in the Commerce Product's Name text field. This can lead to unauthorized actions being performed on behalf of users, data theft, and other malicious activities. The affected versions include Liferay Portal 7.4.0 through 7.4.3.111 and Liferay DXP 2023.Q4.0 through 2023.Q4.5, among others.
How To Fix
Minimum fixed version
6.0.134
This is the first release that contains the fix.
Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, ensure that user input is properly sanitized and validated before being processed by the application. This can help mitigate the risk of XSS attacks until the package is updated.
Conclusion
In summary, the CVE-2025-43821 vulnerability in the Liferay Commerce Product Service poses a significant risk due to its potential for XSS attacks. Users are advised to update to the patched version to mitigate this risk and ensure the security of their applications.
See every vulnerability recorded for com.liferay.commerce:com.liferay.commerce.product.service →
FAQ
CVE-2025-43821 is a cross-site scripting (XSS) vulnerability found in the Liferay Commerce Product Service, allowing attackers to inject malicious scripts.
The affected versions include Liferay Portal 7.4.0 through 7.4.3.111 and Liferay DXP 2023.Q4.0 through 2023.Q4.5, among others.
You can use Vulert to monitor and alert for open-source vulnerabilities in your software. Visit the Vulert playground at Vulert Scanner to check if your application is affected without any signup.
Exploitation of this vulnerability can lead to unauthorized actions, data theft, and compromise of user accounts.
Yes, a patch is available in version 6.0.134 of the Liferay Commerce Product Service. It is recommended to update to this version.
