Multiple stored cross-site scripting (XSS) vulnerabilities in Liferay Portal 7.4.3.15 through 7.4.3.111, and Liferay DXP 2023.Q4.0 through 2023.Q4.5, 2023.Q3.1 through 2023.Q3.8, and 7.4 update 15 through update 92 allow remote attackers to inject arbitrary web script or HTML via crafted payload injected into a Terms and Condition's Name text field to (1) Payment Terms, or (2) the Delivery Term…
Severity
Medium 4.8
Published
7 Oct 2025
Last changed
18 Oct 2026
Added to UpHeron
1 Nov 2026
Fixed in
7.4.3.112, 2023.q3.9, 2023.q4.6
Sources
NVD
Affected software
Software
Affected versions
Liferay Portal / DXPServers and applications · cpe:a:liferay:digital_experience_platform
From 2023.q4.0 before 2023.q4.6
From 2023.q3.1 before 2023.q3.9
Version 7.4-update92
Version 7.4-update91
All 80 release lines
Version 7.4-update15
Version 7.4-update16
Version 7.4-update17
Version 7.4-update18
Version 7.4-update19
Version 7.4-update20
Version 7.4-update21
Version 7.4-update22
Version 7.4-update23
Version 7.4-update24
Version 7.4-update25
Version 7.4-update26
Version 7.4-update27
Version 7.4-update28
Version 7.4-update29
Version 7.4-update30
Version 7.4-update31
Version 7.4-update32
Version 7.4-update33
Version 7.4-update34
Version 7.4-update35
Version 7.4-update36
Version 7.4-update37
Version 7.4-update38
Version 7.4-update39
Version 7.4-update40
Version 7.4-update41
Version 7.4-update42
Version 7.4-update43
Version 7.4-update44
Version 7.4-update45
Version 7.4-update46
Version 7.4-update47
Version 7.4-update48
Version 7.4-update49
Version 7.4-update50
Version 7.4-update51
Version 7.4-update52
Version 7.4-update53
Version 7.4-update54
Version 7.4-update55
Version 7.4-update56
Version 7.4-update57
Version 7.4-update58
Version 7.4-update59
Version 7.4-update60
Version 7.4-update61
Version 7.4-update62
Version 7.4-update63
Version 7.4-update64
Version 7.4-update65
Version 7.4-update66
Version 7.4-update67
Version 7.4-update68
Version 7.4-update69
Version 7.4-update70
Version 7.4-update71
Version 7.4-update72
Version 7.4-update73
Version 7.4-update74
Version 7.4-update75
Version 7.4-update76
Version 7.4-update77
Version 7.4-update78
Version 7.4-update79
Version 7.4-update80
Version 7.4-update81
Version 7.4-update82
Version 7.4-update83
Version 7.4-update84
Version 7.4-update85
Version 7.4-update86
Version 7.4-update87
Version 7.4-update88
Version 7.4-update89
Version 7.4-update90
Version 7.4-update91
Version 7.4-update92
From 2023.q3.1 before 2023.q3.9
From 2023.q4.0 before 2023.q4.6
Liferay Portal / DXPServers and applications · cpe:a:liferay:liferay_portal