Volerion logoVolerion
Volerion logoVolerion

Liferay Portal and Liferay DXP Stored Cross-Site Scripting Vulnerability in Web Content Translation

Vulnerability

A stored cross-site scripting vulnerability has been identified in the Web Content translation feature of Liferay Portal and Liferay DXP. This vulnerability allows remote attackers to inject arbitrary web scripts or HTML into any rich text field of a web content article. The issue affects Liferay Portal versions 7.4.0 through 7.4.3.112, as well as several versions of Liferay DXP, including 2023.Q4.0 through 2023.Q4.8, 2023.Q3.1 through 2023.Q3.10, and 7.4 GA through update 92.

Impact

Exploitation of this vulnerability allows for stored cross-site scripting, where injected scripts are executed in the context of the user viewing the content.

Remediation

Users can upgrade to Liferay Portal 7.4.3.113, Liferay DXP 2024.Q2.0, Liferay DXP 2024.Q1.3, or Liferay DXP 2023.Q4.9 to address this vulnerability.

Added: Sep 30, 2025, 11:19 PM
Updated: Sep 30, 2025, 11:19 PM

Vulnerability Rating

Custom Algorithm
spread
3.1
impact
1.7
exploitability
5.0
remediation
7.7
relevance
0.6
threat
0.0
urgency
2.9
incentive
1.7

Our algorithm analyzes dozens of metrics to generate these 8 key vulnerability categories, which are then combined to calculate the overall risk score.