Liferay Portal v7.1.0 through v7.4.2 and Liferay DXP 7.1 before fix pack 26, 7.2 before fix pack 15, and 7.3 before service pack 3 was discovered to contain a cross-site scripting (XSS) vulnerability in the Portal Search module's Custom Facet widget. This vulnerability allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the Custom Parameter Name text…
Severity
Medium 6.1
Published
22 Sept 2022
Last changed
9 Jul 2026
Added to UpHeron
1 Nov 2026
Fixed in
7.4.3.4
Sources
NVD
Affected software
Software
Affected versions
Liferay Portal / DXPServers and applications · cpe:a:liferay:digital_experience_platform
Version 7.2-fix_pack_14
Version 7.2-fix_pack_13
Version 7.2-fix_pack_12
Version 7.2-fix_pack_11
All 41 release lines
Version 7.1
Version 7.1-fix_pack_1
Version 7.1-fix_pack_2
Version 7.1-fix_pack_3
Version 7.1-fix_pack_4
Version 7.1-fix_pack_5
Version 7.1-fix_pack_6
Version 7.1-fix_pack_7
Version 7.1-fix_pack_8
Version 7.1-fix_pack_9
Version 7.1-fix_pack_10
Version 7.1-fix_pack_11
Version 7.1-fix_pack_12
Version 7.1-fix_pack_13
Version 7.1-fix_pack_14
Version 7.1-fix_pack_15
Version 7.1-fix_pack_16
Version 7.1-fix_pack_17
Version 7.1-fix_pack_18
Version 7.1-fix_pack_19
Version 7.1-fix_pack_20
Version 7.1-fix_pack_21
Version 7.1-fix_pack_22
Version 7.1-fix_pack_23
Version 7.1-fix_pack_24
Version 7.1-fix_pack_25
Version 7.2
Version 7.2-fix_pack_1
Version 7.2-fix_pack_2
Version 7.2-fix_pack_3
Version 7.2-fix_pack_4
Version 7.2-fix_pack_5
Version 7.2-fix_pack_6
Version 7.2-fix_pack_7
Version 7.2-fix_pack_8
Version 7.2-fix_pack_9
Version 7.2-fix_pack_10
Version 7.2-fix_pack_11
Version 7.2-fix_pack_12
Version 7.2-fix_pack_13
Version 7.2-fix_pack_14
Liferay Portal / DXPServers and applications · cpe:a:liferay:liferay_portal