CVE-2025-43774
Liferay Portal is vulnerable to XSS attack through its Style Book theme
CVE-2025-43774 has been rejected by its source and should not be treated as a live vulnerability, published September 9, 2025. Fixed in com.liferay:com.liferay.frontend.taglib.clay 15.2.1.
- Severity
- 2.1 LowCVSS 4.0, GitHub Advisories
- Exploit chance
- UnscoredNo EPSS score yet
- Exploitation
- None knownNot on CISA’s or ENISA’s lists
- Fixed in
15.2.1com.liferay:com.liferay.frontend.taglib.clay +1 more
Description
This CVE ID is rejected. The reported vulnerability was found to be present only in a feature that was under development and protected by a beta feature flag. As a result, the issue was not exploitable in the official or public releases within the specified affected ranges, making this a false positive for officially released versions.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- High
- Privileges needed
- High
- User interaction
- None
What an attacker can affect
- Confidentiality
- Low
- Integrity
- Low
- Availability
- None
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
com.liferay:com.liferay.frontend.taglib.clayMaven | before 15.2.1 | 15.2.1 |
com.liferay:com.liferay.frontend.taglib.clayMaven | before 15.2.1, plus listed versions 1.0.01.0.11.0.21.0.31.0.4 Show 45 moreShow less1.0.51.0.61.0.71.1.01.1.11.1.21.2.01.2.11.2.21.2.31.2.41.2.51.2.61.2.71.3.01.3.11.4.01.4.11.4.101.4.111.4.121.4.131.4.141.4.151.4.161.4.171.4.181.4.191.4.21.4.201.4.211.4.221.4.231.4.241.4.31.4.41.4.51.4.61.4.71.4.81.4.910.0.011.0.011.0.111.1.0 | 15.2.1 |
What each source reports
GitHub Advisories Score usedGHSA-qgj5-4qvg-2f8c
Liferay Portal is vulnerable to XSS attack through its Style Book theme
A reflected cross-site scripting (XSS) vulnerability in the Liferay Portal 7.4.3.132, and Liferay DXP 2025.Q1.0 through 2025.Q1.17 allows a remote authenticated user to inject JavaScript code via Style Book theme name. This malicious payload is then reflected and executed within the user's browser.
- Record
GHSA-qgj5-4qvg-2f8c- CVSS 4.0
- 2.1 Low
CVSS:4.0/AV:N/AC:H/AT:N/PR:H/UI:N/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N - Weakness
- CWE-79
- Updated
- 2026-11-02
CVE ListNo score
This CVE ID is rejected. The reported vulnerability was found to be present only in a feature that was under development and protected by a beta feature flag. As a result, the issue was not exploitable in the official or public releases within the specified affected ranges, making this a false positive for officially released versions.
- Record
CVE-2025-43774- Updated
- 2026-11-02
EUVDEUVD-2025-27257
This CVE ID is rejected. The reported vulnerability was found to be present only in a feature that was under development and protected by a beta feature flag. As a result, the issue was not exploitable in the official or public releases within the specified affected ranges, making this a false positive for officially released versions.
- Record
EUVD-2025-27257- CVSS
- 0.0 None
CVSS:4.0/AV:N/AC:H/AT:N/PR:H/UI:N/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N - Updated
- 2026-11-02
NVDNo score
Rejected reason: This CVE ID is rejected. The reported vulnerability was found to be present only in a feature that was under development and protected by a beta feature flag. As a result, the issue was not exploitable in the official or public releases within the specified affected ranges, making this a false positive for officially released versions.
- Record
CVE-2025-43774- Updated
- 2026-11-02
OSVGHSA-qgj5-4qvg-2f8c
Liferay Portal is vulnerable to XSS attack through its Style Book theme
A reflected cross-site scripting (XSS) vulnerability in the Liferay Portal 7.4.3.132, and Liferay DXP 2025.Q1.0 through 2025.Q1.17 allows a remote authenticated user to inject JavaScript code via Style Book theme name. This malicious payload is then reflected and executed within the user's browser.
- Record
GHSA-qgj5-4qvg-2f8c- CVSS 4.0
- 2.1 Low
CVSS:4.0/AV:N/AC:H/AT:N/PR:H/UI:N/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N - Weakness
- CWE-79
- Updated
- 2026-11-02
History
| Recorded | Changed | Sources |
|---|---|---|
| first indexed | CVE List, EUVD, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
References
nvd.nist.gov/vuln/detail/CVE-2025-43774
liferay.dev/portal/security/known-vulnerabilities/-/asset_publisher/jekt/content/CVE-2025-43774
github.com/liferay/liferay-portal/commit/e15df92e3faa3abbf38e3643b79ab8cf2983d6df
liferay.atlassian.net/browse/LPE-18222
Left out here: 318 versions. The JSON record has them.