CVE-2025-62265

The record

Cross-site scripting (XSS) vulnerability in the Blogs widget in Liferay Portal 7.4.0 through 7.4.3.111, and older unsupported versions, and Liferay DXP 2023.Q4.0 through 2023.Q4.10, 2023.Q3.1 through 2023.Q3.8, 7.4 GA through update 92, 7.3 GA through update 36, and older unsupported versions allows remote attackers to inject arbitrary web script or HTML via a crafted <iframe> injected into a blog entry's “Content” text field. The Blogs widget in Liferay DXP does not add the sandbox attribute to <iframe> elements, which allows remote attackers to access the parent page via scripts and links in the frame page.

Affected packages

Related vulnerabilities

• GHSA-56jv-4ww3-65mw Liferay Portal is vulnerable to XSS in the Blogs widget Same vulnerability
• CVE-2025-62264 Liferay Portal Vulnerable to Reflected XSS via the selectedLanguageId Parameter Also affects com.liferay.portal:release.portal.bom
• GHSA-f5vh-4rj2-w8r8 Liferay Portal is vulnerable to DNS rebinding attacks Also affects com.liferay.portal:release.portal.bom
• GHSA-8hw3-ghwv-crfh Liferay Portal vulnerable to password enumeration Also affects com.liferay.portal:release.portal.bom
• CVE-2025-62266 Liferay Portal is vulnerable to DNS rebinding attacks Also affects com.liferay.portal:release.portal.bom
• CVE-2025-62257 Liferay Portal vulnerable to password enumeration Also affects com.liferay.portal:release.portal.bom
• GHSA-gh4w-8qgq-8w9r Liferay Portal Vulnerable to CSRF in Headless APIs Also affects com.liferay.portal:release.portal.bom
• GHSA-gv7w-jh8g-vr73 Liferay Portal Does Not Limit Access to APIs Before Email Verification Also affects com.liferay.portal:release.portal.bom