CVE-2025-43823: Liferay DXP Commerce Widget XSS Flaw

CVE-2025-43823 Overview

CVE-2025-43823 is a stored cross-site scripting (XSS) vulnerability [CWE-79] in the Commerce Search Result widget of Liferay Portal and Liferay Digital Experience Platform (DXP). An authenticated attacker can inject arbitrary HTML or JavaScript by placing a crafted payload into a Commerce Product's Name text field. When the Commerce Search Result widget renders that product name, the injected script executes in the browser of any user viewing the results.

The vulnerability affects Liferay Portal versions 7.4.0 through 7.4.3.111, Liferay DXP 2023.Q4 before patch 6, 2023.Q3 before patch 9, and 7.4 GA through update 92.

Critical Impact
Authenticated attackers can execute arbitrary script in the context of Commerce Search Result users, enabling session theft, account takeover, and unauthorized actions within the Liferay portal.

Affected Products

Liferay Portal 7.4.0 through 7.4.3.111
Liferay DXP 2023.Q4 before patch 6 and 2023.Q3 before patch 9
Liferay DXP 7.4 GA through update 92

Discovery Timeline

2025-10-07 - CVE-2025-43823 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-43823

Vulnerability Analysis

The Commerce Search Result widget renders product names supplied through Liferay's Commerce catalog without sufficient output encoding. Because product Name values are treated as trusted display text, HTML control characters and <script> tags submitted through the product creation or edit interface persist in the database and are echoed back to any user whose search matches the product.

The result is a stored XSS condition. Every visitor to a page hosting the Commerce Search Result widget can trigger the payload simply by entering a search that returns the malicious product. Payloads run in the origin of the Liferay site with the privileges of the viewing user, including administrators.

Root Cause

The root cause is missing or incomplete HTML entity encoding of the Commerce Product Name field on the render path used by the Commerce Search Result widget. Input validation on write also fails to strip or reject markup, so untrusted content reaches the DOM verbatim [CWE-79].

Attack Vector

Exploitation requires network access to the Liferay instance and low-privilege authenticated access to the Commerce catalog editing capability. User interaction is required: a victim must load a page rendering the Commerce Search Result widget that returns the crafted product. Because the payload is stored, no direct social engineering of individual victims is needed beyond ensuring the product appears in search results.

No verified exploit code is publicly available. Refer to the Liferay CVE-2025-43823 advisory for vendor-supplied technical details.

Detection Methods for CVE-2025-43823

Indicators of Compromise

Commerce Product records whose Name field contains HTML tags, <script>, on*= event handlers, or javascript: URIs.
Web server or reverse-proxy logs showing POST or PUT requests to Commerce catalog endpoints with encoded angle brackets in the product name parameter.
Content Security Policy (CSP) violation reports referencing inline script executions on pages hosting the Commerce Search Result widget.
Unexpected outbound requests from user browsers to attacker-controlled domains sourced from Liferay Commerce pages.

Detection Strategies

Query the Liferay database for Commerce product name fields containing angle brackets, HTML entities, or JavaScript keywords.
Enable and monitor CSP with report-uri or report-to directives across Liferay Commerce pages to flag script executions from user-supplied content.
Correlate authenticated Commerce catalog edits with subsequent anomalous session activity from users viewing the affected search widget.

Monitoring Recommendations

Alert on writes to Commerce Product Name fields that fail server-side allowlist validation for length and character class.
Monitor administrator session behavior for token exfiltration attempts following visits to Commerce search pages.
Track patch level of every Liferay Portal and DXP node and alert when nodes fall behind the fixed versions listed in the vendor advisory.

How to Mitigate CVE-2025-43823

Immediate Actions Required

Apply the Liferay-supplied patch corresponding to your deployment channel (DXP 2023.Q4 patch 6, 2023.Q3 patch 9, or 7.4 update 93 or later).
Audit existing Commerce Product records and remove or sanitize any Name values containing HTML or script content.
Restrict Commerce catalog editing roles to trusted users until patches are deployed.

Patch Information

Liferay published fixes and guidance in the Liferay CVE-2025-43823 advisory. Upgrade Liferay Portal to a version above 7.4.3.111, and apply the referenced DXP patches for 2023.Q4, 2023.Q3, and 7.4 streams.

Workarounds

Temporarily remove the Commerce Search Result widget from public-facing pages until patches are applied.
Deploy a strict Content Security Policy that disallows inline script execution (script-src 'self') on all Commerce-rendering pages.
Enforce a web application firewall rule that rejects Commerce catalog write requests containing <, >, or javascript: sequences in the product name parameter.

bash

# Configuration example: restrictive CSP header for Liferay Commerce pages
add_header Content-Security-Policy "default-src 'self'; script-src 'self'; object-src 'none'; base-uri 'self'; report-uri /csp-report" always;