CVE-2022-26594: Liferay Portal

Medium severity, CVSS 6.1. EPSS: 0.7% chance of exploitation in the next 30 days.

Multiple cross-site scripting (XSS) vulnerabilities in Liferay Portal 7.3.5 through 7.4.0, and Liferay DXP 7.3 before service pack 3 allow remote attackers to inject arbitrary web script or HTML via a form field's help text to (1) Forms module's form builder, or (2) App Builder module's object form view's form builder.

Affected products

• Liferay Liferay Portal: from 7.3.5, before 7.3.7 (fixed in 7.3.7); version 7.4.0 only

Published 2022-04-15. Last modified 2026-07-09.