CVE-2025-43823: XSS Vulnerability in Liferay Portal's Commerce Search Result Widget
Summary
CVE-2025-43823: Liferay Portal is vulnerable to XSS through its Commerce Search Result widget. Affects com.liferay.portal:release.portal.bom versions >= 7.4.0, < 7.4.3.112-ga112. Fixed in 7.4.3.112-ga112. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Liferay Portal is a popular open-source platform designed for building web applications and managing digital experiences. It offers a variety of features, including content management, collaboration tools, and commerce capabilities. The platform's Commerce Search Result widget is integral for displaying product information, but it has been found to be vulnerable to cross-site scripting (XSS) attacks, which can allow malicious users to inject harmful scripts into web pages.
Vulnerability Detail
The vulnerability arises from improper handling of user input in the Commerce Product's Name text field within Liferay Portal versions 7.4.0 to 7.4.3.111 and Liferay DXP 2023.Q4 before patch 6. Attackers can exploit this flaw by injecting arbitrary web scripts or HTML, potentially leading to unauthorized actions, data theft, or defacement of the web application. This XSS vulnerability is classified under CWE-79, indicating a critical security oversight in input validation.
How To Fix
Latest published version: 7.4.3.132 as of 22 Oct 2026
Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
7.4.3.112-ga112
This is the first release that contains the fix.
Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
If immediate patching is not feasible, consider implementing input validation and sanitization on the Commerce Product's Name text field to mitigate the risk of XSS attacks. This can be done by escaping special characters and filtering out potentially harmful scripts before rendering user input on the web page.
Conclusion
The CVE-2025-43823 vulnerability in Liferay Portal's Commerce Search Result widget poses a significant risk due to its potential for XSS attacks. It is crucial for users of affected versions to apply the recommended patch or implement workarounds to safeguard their applications from exploitation.
See every vulnerability recorded for com.liferay.portal:release.portal.bom →
FAQ
CVE-2025-43823 is a cross-site scripting (XSS) vulnerability found in Liferay Portal's Commerce Search Result widget, allowing attackers to inject malicious scripts.
The vulnerability affects Liferay Portal versions 7.4.0 through 7.4.3.111 and Liferay DXP 2023.Q4 before patch 6.
You can use Vulert, which monitors open-source vulnerabilities in your software by analyzing the pom.xml file. Visit Vulert Scanner to check your application without signup.
Exploitation of this vulnerability can lead to unauthorized actions, data theft, or defacement of the web application, compromising user trust and security.
Update your pom.xml file to include the patched version 7.4.3.112-ga112 for the affected package and rebuild your project.
References
Related vulnerabilities
Recent vulnerabilities recorded for com.liferay.portal:release.portal.bom.
