Liferay Commerce CVE-2025-62237

Requires a low-privileged authenticated Liferay Commerce account (PR:L) capable of editing the Account 'Name' text field, which is where the arbitrary script/HTML is stored. Exploitation is NOT automatic: a second user (UI:A / UI:R) - in practice a store operator or administrator - must subsequently open the affected account's order on the Commerce view order page for the stored payload to execute. Affected deployments are Liferay Portal 7.4.3.8-7.4.3.111 and Liferay DXP 2023.Q4.0-2023.Q4.5, 2023.Q3.1-2023.Q3.8, and 7.4 update 8-92 that have the Commerce module in use; portals without Commerce/order workflows are not exposed. Limiting factors: authentication requirement, mandatory privileged-victim interaction, and dependence on the Commerce feature being deployed.

This is a genuinely medium/low-priority issue, and the signals are mutually consistent rather than conflicting. The CVSS 4.0 vector (AV:N/AC:L/PR:L/UI:A) yields only 4.8, reflecting that exploitation requires an authenticated account (PR:L) and active victim interaction (UI:A), with only low confidentiality and integrity impact (VC:L/VI:L) and no availability impact. EPSS reinforces low real-world risk at 0.22% (12th percentile). There is no CISA KEV listing and no public POC identified, so exploitation status is 'no public exploit identified at time of analysis.' No SSVC decision data was provided in the input. The one caveat is scope: stored XSS executes in a victim's browser session, so the practical impact (session/token theft, actions as the viewing user) can exceed the modest numeric score if the victim is a privileged store operator or administrator - but nothing here indicates widespread or automatable exploitation. Overall this is a high-severity-vector-but-low-real-risk profile: a legitimate bug worth patching on a normal cycle, not an emergency.

An attacker with a low-privileged Commerce account sets their Account 'Name' field to a crafted payload containing malicious script/HTML. When a store operator or administrator later opens that account's order via the Commerce view order page, the stored payload executes in the privileged viewer's browser, enabling session-context actions such as cookie/token theft or UI manipulation. No public exploit code has been identified, and a victim must actively view the affected page (UI:A) for the attack to fire.