Multiple cross-site scripting (XSS) vulnerabilities in Liferay Portal 7.3.7 through 7.4.3.103, and Liferay DXP 2023.Q3.1 through 2023.Q3.4, 7.4 GA through update 92, 7.3 service pack 3 through update 36 allow remote attackers to inject arbitrary web script or HTML via a crafted payload injected into an Account Role’s “Title” text field to (1) view account role page, or (2) select account role…
Severity
Medium 4.8
Published
27 Oct 2025
Last changed
18 Oct 2026
Added to UpHeron
1 Nov 2026
Fixed in
7.4.3.104
Sources
NVD
Affected software
Software
Affected versions
Liferay Portal / DXPServers and applications · cpe:a:liferay:digital_experience_platform
Version 2023.q3.4
Version 2023.q3.3
Version 2023.q3.2
Version 2023.q3.1
All 42 release lines
Version 7.3-service_pack_3
Version 7.3-update1
Version 7.3-update2
Version 7.3-update3
Version 7.3-update4
Version 7.3-update5
Version 7.3-update6
Version 7.3-update7
Version 7.3-update8
Version 7.3-update9
Version 7.3-update10
Version 7.3-update11
Version 7.3-update12
Version 7.3-update13
Version 7.3-update14
Version 7.3-update15
Version 7.3-update16
Version 7.3-update17
Version 7.3-update18
Version 7.3-update19
Version 7.3-update20
Version 7.3-update21
Version 7.3-update22
Version 7.3-update23
Version 7.3-update24
Version 7.3-update25
Version 7.3-update26
Version 7.3-update27
Version 7.3-update28
Version 7.3-update29
Version 7.3-update30
Version 7.3-update31
Version 7.3-update32
Version 7.3-update33
Version 7.3-update34
Version 7.3-update35
Version 7.3-update36
Version 7.4
Version 2023.q3.1
Version 2023.q3.2
Version 2023.q3.3
Version 2023.q3.4
Liferay Portal / DXPServers and applications · cpe:a:liferay:liferay_portal