Liferay DXP CVE-2025-43821

Requires a Liferay Commerce deployment that uses the Commerce Product Comparison Table widget, plus an authenticated account with privileges to create or edit a Commerce Product and write to its Name text field (PR:L). Exploitation is a stored/persistent XSS, so it only triggers when a victim actively navigates to and renders the comparison table containing the malicious product (UI:A). Limiting factors: attacker must be authenticated with catalog-edit rights, the Commerce module and this specific widget must be deployed and in use, and a separate victim must view the affected table - there is no unauthenticated or no-interaction path.

This is a low-to-moderate priority, stored cross-site scripting flaw (CWE-79) rather than a critical issue. The vendor-supplied CVSS 4.0 vector (CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:A/VC:L/VI:L/VA:N) scores 4.8 (Medium), and all signals are internally consistent: network-reachable but requiring low-level privileges (PR:L - an authenticated user able to create or edit a Commerce Product) plus active victim interaction (UI:A - someone must view the rendered comparison table). Impact is limited to Low confidentiality and Low integrity with no availability or subsequent-system impact. The EPSS score of 0.22% (12th percentile) corroborates low expected exploitation likelihood, and there is no CISA KEV listing and no public exploit identified, so there is no evidence of active exploitation or weaponization. No signals conflict here - the CVSS, EPSS, and absence of KEV/POC all point the same direction: a genuine but low-urgency vulnerability best handled through routine patching. The authentication requirement (PR:L) is the key mitigating factor that keeps this well below the threshold of an unauthenticated, wormable web flaw.

An authenticated user with permission to create or edit Commerce catalog entries injects a malicious script payload into a Commerce Product's Name text field. When another user (for example a shopper or administrator) loads a page containing the Commerce Product Comparison Table widget, the stored payload executes in their browser, potentially stealing session data or performing actions in their context. No public exploit code is identified at time of analysis, and successful exploitation requires the victim to actively view the affected widget.