CVE-2025-43820
Liferay Portal vulnerable to cross-site scripting in the Calendar widget
Multiple cross-site scripting (XSS) vulnerabilities in the Calendar widget when inviting users to a event in Liferay Portal 7.4.3.35 through 7.4.3.110, and Liferay DXP 2023.Q4.0 through 2023.Q4.4, 2023.Q3.1 through 2023.Q3.6, 7.4 update 35 through update 92, and 7.3 update 25 through update 35 allow remote attackers to inject arbitrary web script or HTML via a crafted payload injected into a user’s (1) First Name, (2) Middle text, or (3) Last Name text fields.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- Low
- User interaction
- Active
What an attacker can affect
- Confidentiality
- Low
- Integrity
- Low
- Availability
- None
Exploit likelihood
What each source reports
CVE List Score used
Multiple cross-site scripting (XSS) vulnerabilities in the Calendar widget when inviting users to a event in Liferay Portal 7.4.3.35 through 7.4.3.110, and Liferay DXP 2023.Q4.0 through 2023.Q4.4, 2023.Q3.1 through 2023.Q3.6, 7.4 update 35 through update 92, and 7.3 update 25 through update 35 allow remote attackers to inject arbitrary web script or HTML via a crafted payload injected into a user’s (1) First Name, (2) Middle text, or (3) Last Name text fields.
- Record
CVE-2025-43820- CVSS 4.0
- 4.8 Medium
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:A/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N - Weakness
- CWE-79
- Updated
- 2026-11-02
EUVDEUVD-2025-31649
Multiple cross-site scripting (XSS) vulnerabilities in the Calendar widget when inviting users to a event in Liferay Portal 7.4.3.35 through 7.4.3.110, and Liferay DXP 2023.Q4.0 through 2023.Q4.4, 2023.Q3.1 through 2023.Q3.6, 7.4 update 35 through update 92, and 7.3 update 25 through update 35 allow remote attackers to inject arbitrary web script or HTML via a crafted payload injected into a user’s (1) First Name, (2) Middle text, or (3) Last Name text fields.
- Record
EUVD-2025-31649- CVSS 4.0
- 4.8 Medium
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:A/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N - Updated
- 2026-11-02
GitHub AdvisoriesGHSA-pf86-4w35-cj89
Liferay Portal vulnerable to cross-site scripting in the Calendar widget
Multiple cross-site scripting (XSS) vulnerabilities in the Calendar widget when inviting users to a event in Liferay Portal 7.4.3.35 through 7.4.3.110, and Liferay DXP 2023.Q4.0 through 2023.Q4.4, 2023.Q3.1 through 2023.Q3.6, 7.4 update 35 through update 92, and 7.3 update 25 through update 35 allow remote attackers to inject arbitrary web script or HTML via a crafted payload injected into a user’s (1) First Name, (2) Middle text, or (3) Last Name text fields.
- Record
GHSA-pf86-4w35-cj89- CVSS 4.0
- 4.8 Medium
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:A/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N - Weakness
- CWE-79
- Updated
- 2026-11-02
NVD
Multiple cross-site scripting (XSS) vulnerabilities in the Calendar widget when inviting users to a event in Liferay Portal 7.4.3.35 through 7.4.3.110, and Liferay DXP 2023.Q4.0 through 2023.Q4.4, 2023.Q3.1 through 2023.Q3.6, 7.4 update 35 through update 92, and 7.3 update 25 through update 35 allow remote attackers to inject arbitrary web script or HTML via a crafted payload injected into a user’s (1) First Name, (2) Middle text, or (3) Last Name text fields.
- Record
CVE-2025-43820- CVSS 4.0
- 4.8 Medium
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:A/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X - CVSS 3.1
- 5.4 Medium
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N - Weakness
- CWE-79
- Updated
- 2026-11-02
OSV
Multiple cross-site scripting (XSS) vulnerabilities in the Calendar widget when inviting users to a event in Liferay Portal 7.4.3.35 through 7.4.3.110, and Liferay DXP 2023.Q4.0 through 2023.Q4.4, 2023.Q3.1 through 2023.Q3.6, 7.4 update 35 through update 92, and 7.3 update 25 through update 35 allow remote attackers to inject arbitrary web script or HTML via a crafted payload injected into a user’s (1) First Name, (2) Middle text, or (3) Last Name text fields.
- Record
CVE-2025-43820- CVSS 3.1
- 5.4 Medium
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N - Updated
- 2026-11-02
OSVGHSA-pf86-4w35-cj89
Liferay Portal vulnerable to cross-site scripting in the Calendar widget
Multiple cross-site scripting (XSS) vulnerabilities in the Calendar widget when inviting users to a event in Liferay Portal 7.4.3.35 through 7.4.3.110, and Liferay DXP 2023.Q4.0 through 2023.Q4.4, 2023.Q3.1 through 2023.Q3.6, 7.4 update 35 through update 92, and 7.3 update 25 through update 35 allow remote attackers to inject arbitrary web script or HTML via a crafted payload injected into a user’s (1) First Name, (2) Middle text, or (3) Last Name text fields.
- Record
GHSA-pf86-4w35-cj89- CVSS 4.0
- 4.8 Medium
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:A/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N - Weakness
- CWE-79
- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
com.liferay.portal:release.portal.bomMaven |
7.4.3.35-ga35 to 7.4.3.110-ga110 | 7.4.3.111-ga111 |
com.liferay:com.liferay.calendar.webMaven |
5.0.45 up to 5.0.88 | 5.0.88 |
com.liferay.portal:release.portal.bomMaven |
7.4.3.35-ga35 up to 7.4.3.111-ga111, plus listed versions 7.4.3.1007.4.3.1017.4.3.1027.4.3.1037.4.3.104 Show 45 moreShow less7.4.3.1057.4.3.1067.4.3.1077.4.3.367.4.3.377.4.3.387.4.3.397.4.3.407.4.3.417.4.3.427.4.3.437.4.3.447.4.3.457.4.3.467.4.3.477.4.3.487.4.3.497.4.3.507.4.3.517.4.3.527.4.3.537.4.3.547.4.3.557.4.3.567.4.3.577.4.3.587.4.3.597.4.3.607.4.3.60-ga607.4.3.617.4.3.61-ga617.4.3.627.4.3.637.4.3.647.4.3.657.4.3.667.4.3.677.4.3.687.4.3.697.4.3.707.4.3.717.4.3.727.4.3.737.4.3.747.4.3.75 |
7.4.3.111-ga111 |
com.liferay:com.liferay.calendar.webMaven |
5.0.45 up to 5.0.88, plus listed versions 5.0.465.0.475.0.485.0.495.0.50 Show 37 moreShow less5.0.515.0.525.0.535.0.545.0.555.0.565.0.575.0.585.0.595.0.605.0.615.0.625.0.635.0.645.0.655.0.665.0.675.0.685.0.695.0.705.0.715.0.725.0.735.0.745.0.755.0.765.0.775.0.785.0.795.0.805.0.815.0.825.0.835.0.845.0.855.0.865.0.87 |
5.0.88 |
History
| Recorded | Changed | Sources |
|---|---|---|
| first indexed | CVE List, EUVD, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2025-43820 is a medium vulnerability (CVSS 4.8) in Liferay Dxp, published September 29, 2025. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.22%, the 12th percentile. Fixed in com.liferay.portal:release.portal.bom 7.4.3.111-ga111.
References
Left out here: 26 versions. The JSON record has them.