CVE-2023-44310: Liferay Digital Experience Platform

Medium severity, CVSS 5.4. EPSS: 0.5% chance of exploitation in the next 30 days.

Stored cross-site scripting (XSS) vulnerability in Page Tree menu Liferay Portal 7.3.6 through 7.4.3.78, and Liferay DXP 7.3 fix pack 1 through update 23, and 7.4 before update 79 allows remote attackers to inject arbitrary web script or HTML via a crafted payload injected into page's "Name" text field.

Affected products

• Liferay Digital Experience Platform: version 7.1 only; version 7.4 only
• Liferay Liferay Portal: from 7.3.6, before 7.4.3.49 (fixed in 7.4.3.49)

Published 2023-10-17. Last modified 2026-06-17.