--- id: CVE-2025-43783 title: >- Reflected cross-site scripting (XSS) vulnerability in Liferay Portal 7.4.3.73 through 7.4.3.128, and Liferay DXP 2024.Q3.0 through 2024.Q3.1, 2024.Q2.0 through 2024.Q2.13, 2024.Q1.1 through 2024.Q1.12, 7.4 update 73 through update 92 all… summary: >- Reflected cross-site scripting (XSS) vulnerability in Liferay Portal 7.4.3.73 through 7.4.3.128, and Liferay DXP 2024.Q3.0 through 2024.Q3.1, 2024.Q2.0 through 2024.Q2.13, 2024.Q1.1 through 2024.Q1.12, 7.4 update 73 through update 92 all… severity: medium cvss: 6.1 cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N' cwe: - CWE-79 vendor: liferay product: digital_experience_platform affected: - 'digital_experience_platform >= 2024.Q1.1, < 2024.Q1.13' - 'digital_experience_platform >= 2024.q2.0, <= 2024.q2.13' - 'digital_experience_platform >= 2024.Q3.0, < 2024.Q3.2' - digital_experience_platform = 7.4 - 'liferay_portal >= 7.4.0, < 7.4.3.129' patched: - digital_experience_platform 2024.Q3.2 - liferay_portal 7.4.3.129 published: '2025-09-10' updated: '2026-09-26' sourceUpdated: '2026-09-26T00:10:00.127' source: NVD sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2025-43783' references: - url: >- https://liferay.dev/portal/security/known-vulnerabilities/-/asset_publisher/jekt/content/CVE-2025-43783 label: security@liferay.com tags: - nvd epss: 0.00245 epssPercentile: 0.13991 ingestedAt: '2026-09-26T00:22:39.917Z' --- ## Overview Reflected cross-site scripting (XSS) vulnerability in Liferay Portal 7.4.3.73 through 7.4.3.128, and Liferay DXP 2024.Q3.0 through 2024.Q3.1, 2024.Q2.0 through 2024.Q2.13, 2024.Q1.1 through 2024.Q1.12, 7.4 update 73 through update 92 allows remote attackers to inject arbitrary web script or HTML via the /c/portal/comment/discussion/get_editor path. ## Affected - `digital_experience_platform >= 2024.Q1.1, < 2024.Q1.13` - `digital_experience_platform >= 2024.q2.0, <= 2024.q2.13` - `digital_experience_platform >= 2024.Q3.0, < 2024.Q3.2` - `digital_experience_platform = 7.4` - `liferay_portal >= 7.4.0, < 7.4.3.129` ## Remediation Upgrade past the affected range: - `digital_experience_platform 2024.Q3.2` - `liferay_portal 7.4.3.129`