CVE-2025-43804: Liferay search widget vulnerable to Cross-site Scripting

September 17, 2025 (updated November 10, 2025)

There is a Cross-site scripting (XSS) vulnerability in Liferay Portal’s Search widget . Versions 7.4.3.93 through 7.4.3.111, and Liferay DXP 2023.Q4.0, 2023.Q3.1 through 2023.Q3.4 allow remote attackers to inject arbitrary web scripts or HTML via the _com_liferay_portal_search_web_portlet_SearchPortlet_userId parameter.

References

github.com/advisories/GHSA-ccrc-5vp5-vp5j
liferay.dev/portal/security/known-vulnerabilities/-/asset_publisher/jekt/content/CVE-2025-43804
nvd.nist.gov/vuln/detail/CVE-2025-43804

Code Behaviors & Features

Detect and mitigate CVE-2025-43804 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Learn more about Dependency Scanning →