Liferay DXP CVE-2025-62265

Exploitation requires an authenticated account with permission to author or edit Blogs widget entries (PR:L), used to inject a crafted <iframe> into the blog entry's "Content" text field. The root cause is that the Blogs widget does not apply the sandbox attribute to <iframe> elements, so the framed page can access the parent page via its scripts and links. Exploitation is further limited by the need for active user interaction (UI:A) - a victim must view the malicious blog entry for the payload to fire - and impact is confined to low confidentiality/integrity in the victim's browser context. There is no unauthenticated or default-configuration remote path; the attacker must first hold blog-content-authoring rights on the target instance.

This is a stored cross-site scripting (CWE-79) flaw in the Liferay Portal/DXP Blogs widget, rated CVSS 4.0 base 4.8 (Medium). The vendor-supplied vector CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:A/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N tells a consistent, de-escalating story: although the attack vector is network-reachable with low complexity, exploitation requires low-level authenticated privileges (PR:L - an account able to author blog entries) and active victim interaction (UI:A - a user must render the malicious entry), and the impact is limited to low confidentiality and low integrity with no availability impact. No EPSS score, SSVC decision, KEV listing, or POC was provided in the input, so there is no public exploit identified at time of analysis and no evidence of active or automatable exploitation. The combination of required authentication, required user interaction, and only partial C/I impact places this well below urgent-patch priority; it is a genuine but modest risk best characterized as a medium-severity persistent XSS rather than a high-real-risk issue. No signals conflict - the CVSS vector and the description (authenticated blog author injecting an iframe that a viewer renders) agree. The chief residual uncertainty is simply the absence of exploitation-probability telemetry (no EPSS/KEV/POC data supplied).

An attacker with a low-privileged account permitted to create or edit blog entries injects a crafted <iframe> into the blog entry's Content field; because the Blogs widget omits the sandbox attribute, the framed page's scripts and links can reach the parent page. When another authenticated user (potentially an administrator) later views the blog entry, the injected content executes in their browser session, enabling session-context script actions or redirection. No public exploit code is identified at time of analysis, and the network/low-complexity vector is gated by the need for blog-authoring privileges and a victim viewing the entry.