Liferay Commerce CVE-2025-43823

Exploitation requires an authenticated account with privileges to create or edit a Commerce Product and write to its Name text field (PR:L), so this is not remote-unauthenticated. The Liferay Commerce module must be deployed and in use, and the specific Commerce Search Result widget must be rendering product data. Execution additionally requires a victim to view the search result containing the malicious product name (UI:A/active user interaction), limiting it to a stored-XSS-against-other-users scenario rather than a self-contained remote compromise. These factors - authenticated catalog-edit access, use of the Commerce feature, and a separate victim rendering the widget - substantially constrain realistic exploitation.

This is a medium-severity stored cross-site scripting flaw (CWE-79) with a vendor-assigned CVSS 4.0 base score of 4.8, and the signals consistently point to a genuinely low-to-moderate real-world priority rather than an urgent threat. The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:L/UI:A/VC:L/VI:L/VA:N) shows network reach and low attack complexity but requires authenticated low-level privileges (PR:L) plus active victim interaction (UI:A), and only low confidentiality and integrity impact with no availability impact. EPSS reinforces this: 0.22% probability (12th percentile) indicates very low likelihood of observed exploitation. There is no CISA KEV listing and no public exploit code identified, so there is no evidence of active exploitation. The signals are therefore aligned and non-conflicting - a low-CVSS, low-EPSS, non-KEV issue. One caveat: the input provides a CVSS 4.0 vector but a 4.0-style 'Score 4.8' that is self-consistent; no CVSS 3.1 vector was supplied, so cross-framework comparison relies on inference. The PR:L requirement is important - an attacker must already be able to create or edit a Commerce Product's Name field, which meaningfully narrows the threat population to users with catalog/content privileges.

An authenticated user with permission to create or edit Commerce catalog products injects a crafted script payload into a Commerce Product's Name text field. When another user (such as a shopper or administrator) performs a search that renders the Commerce Search Result widget, the stored payload executes in their browser in the context of the Liferay site. No public proof-of-concept or exploit code was identified at the time of analysis, and successful exploitation also depends on a victim triggering the vulnerable widget (UI:A).