CVE-2025-43822: Liferay Portal Multiple Stored XSS Vulnerabilities on View Order Page
Summary
CVE-2025-43822: Liferay Portal has multiple Stored XSS vulnerabilities on its View Order page. Affects com.liferay.portal:release.portal.bom versions >= 7.4.3.15, < 7.4.3.112-ga112. Fixed in 7.4.3.112-ga112. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Liferay Portal is a popular open-source platform used for building web applications and managing content. It provides a robust framework for creating customizable user experiences and supports various functionalities such as user management, content management, and workflow automation. However, certain versions of Liferay Portal are susceptible to stored cross-site scripting (XSS) vulnerabilities, which can allow attackers to inject malicious scripts into web pages viewed by other users.
Vulnerability Detail
The vulnerability arises from multiple stored cross-site scripting (XSS) flaws in Liferay Portal versions 7.4.3.15 through 7.4.3.111 and Liferay DXP versions 2023.Q4.0 through 2023.Q4.5, 2023.Q3.1 through 2023.Q3.8, and 7.4 update 15 through update 92. Attackers can exploit these vulnerabilities by injecting arbitrary web scripts or HTML into the Terms and Condition's Name text field, specifically affecting the Payment Terms and Delivery Term on the view order page. This can lead to unauthorized actions being performed on behalf of users, data theft, or defacement of the web application.
How To Fix
Latest published version: 7.4.3.132 as of 22 Oct 2026
Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
7.4.3.112-ga112
This is the first release that contains the fix.
Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, you can sanitize user inputs in the Terms and Condition's Name text field to prevent the injection of malicious scripts. Ensure that any HTML tags are stripped from user inputs before they are processed or displayed on the web page.
Conclusion
In summary, CVE-2025-43822 highlights significant stored XSS vulnerabilities in Liferay Portal that can be exploited by attackers. It is crucial for users of the affected versions to update to the patched version to safeguard their applications against potential threats.
See every vulnerability recorded for com.liferay.portal:release.portal.bom →
FAQ
CVE-2025-43822 is a vulnerability identifier for multiple stored XSS vulnerabilities found in specific versions of Liferay Portal.
The affected versions include Liferay Portal 7.4.3.15 through 7.4.3.111 and Liferay DXP 2023.Q4.0 through 2023.Q4.5, among others.
Attackers can inject arbitrary web scripts or HTML, potentially leading to unauthorized actions, data theft, or defacement of the application.
You can use Vulert to monitor and alert for open-source vulnerabilities in your software. Visit Vulert Scanner to check if your application is affected without needing to sign up.
If immediate updates are not possible, implement input sanitization to mitigate the risk of XSS attacks until you can apply the patch.
References
Related vulnerabilities
Recent vulnerabilities recorded for com.liferay.portal:release.portal.bom.
