Staging Environment: Content and features may be unstable or change without notice.
Search for vulnerabilities
Vulnerability details: VCID-kb2d-h77f-7yh7
Vulnerability ID VCID-kb2d-h77f-7yh7
Aliases CVE-2024-25610
GHSA-vvpf-53qx-cxhh
Summary Liferay Portal has a Stored XSS with Blog entries (Insecure defaults) In Liferay Portal 7.2.0 through 7.4.3.12, and older unsupported versions, and Liferay DXP 7.4 before update 9, 7.3 before update 4, 7.2 before fix pack 19, and older unsupported versions, the default configuration does not sanitize blog entries of JavaScript, which allows remote authenticated users to inject arbitrary web script or HTML (XSS) via a crafted payload injected into a blog entry’s content text field.
Status Published
Exploitability None
Weighted Severity None
Risk None
Affected and Fixed Packages Package Details
Weaknesses (3)
CWE-1188 Initialization of a Resource with an Insecure Default
CWE-937 OWASP Top Ten 2013 Category A9 - Using Components with Known Vulnerabilities
CWE-1035 OWASP Top Ten 2017 Category A9 - Using Components with Known Vulnerabilities
System Score Found at
epss 0.00106 https://api.first.org/data/v1/epss?cve=CVE-2024-25610
cvssv3.1_qr CRITICAL https://github.com/advisories/GHSA-vvpf-53qx-cxhh
Reference id Reference type URL
https://api.first.org/data/v1/epss?cve=CVE-2024-25610
https://github.com/liferay/liferay-portal
CVE-2024-25610 https://liferay.dev/portal/security/known-vulnerabilities/-/asset_publisher/jekt/content/cve-2024-25610
CVE-2024-25610 https://nvd.nist.gov/vuln/detail/CVE-2024-25610
GHSA-vvpf-53qx-cxhh https://github.com/advisories/GHSA-vvpf-53qx-cxhh
No exploits are available.
Exploit Prediction Scoring System (EPSS)
Percentile 0.28388
EPSS Score 0.00106
Published At May 30, 2026, 12:55 p.m.
Date Actor Action Source VulnerableCode Version
2026-05-30T21:03:21.745986+00:00 GitLab Importer Import https://gitlab.com/gitlab-org/advisories-community/-/blob/main/maven/com.liferay.portal/release.portal.bom/CVE-2024-25610.yml 38.6.0