---
id: CVE-2021-29044
title: >-
  Cross-site scripting (XSS) vulnerability in the Site module's membership
  request administration pages in Liferay Portal 7.0.0 through 7.3.5, and
  Liferay DXP 7.0 before fix pack 97, 7.1 before fix pack 21, 7.2 before fix
  pack 10 and 7.3 b…
summary: >-
  Cross-site scripting (XSS) vulnerability in the Site module's membership
  request administration pages in Liferay Portal 7.0.0 through 7.3.5, and
  Liferay DXP 7.0 before fix pack 97, 7.1 before fix pack 21, 7.2 before fix
  pack 10 and 7.3 b…
severity: medium
cvss: 6.1
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N'
cwe:
  - CWE-79
vendor: liferay
product: digital_experience_platform
affected:
  - digital_experience_platform = 7.0
  - digital_experience_platform = 7.1
  - digital_experience_platform = 7.2
  - dxp = 7.3
  - 'liferay_portal >= 7.0.0, <= 7.3.5'
published: '2021-05-17'
updated: '2026-07-05'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2021-29044'
references:
  - url: >-
      https://portal.liferay.dev/learn/security/known-vulnerabilities/-/asset_publisher/HbL5mxmVrnXW/content/id/120743548
    label: cve@mitre.org
  - url: 'http://liferay.com'
    label: af854a3a-2127-422b-91ae-364da2661108
  - url: >-
      https://portal.liferay.dev/learn/security/known-vulnerabilities/-/asset_publisher/HbL5mxmVrnXW/content/id/120743548
    label: af854a3a-2127-422b-91ae-364da2661108
tags:
  - nvd
epss: 0.00746
epssPercentile: 0.52817
ingestedAt: '2026-07-05T00:59:25.860Z'
---

## Overview

Cross-site scripting (XSS) vulnerability in the Site module's membership request administration pages in Liferay Portal 7.0.0 through 7.3.5, and Liferay DXP 7.0 before fix pack 97, 7.1 before fix pack 21, 7.2 before fix pack 10 and 7.3 before fix pack 1 allows remote attackers to inject arbitrary web script or HTML via the _com_liferay_site_my_sites_web_portlet_MySitesPortlet_comments parameter.

## Affected

- `digital_experience_platform = 7.0`
- `digital_experience_platform = 7.1`
- `digital_experience_platform = 7.2`
- `dxp = 7.3`
- `liferay_portal >= 7.0.0, <= 7.3.5`

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.