ByteOS

Product

Portal

Default Status

unaffected

Versions

Affected

From 7.3.0 through 7.4.3.111 (maven)

Vendor

Product

DXP

Default Status

unaffected

Versions

Affected

From 7.3.10 through 7.3.10-u35 (maven)
From 7.4.13 through 7.4.13-u92 (maven)
From 2023.Q3.1 through 2023.Q3.4 (maven)
2023.Q4.0 (maven)

Problem Types

Type	CWE ID	Description
CWE	CWE-862	CWE-862: Missing Authorization

Type: CWE

CWE ID: CWE-862

Description: CWE-862: Missing Authorization

Metrics

Version	Base score	Base severity	Vector
4.0	6.9	MEDIUM	CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N

Version: 4.0

Base score: 6.9

Base severity: MEDIUM

Vector:

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N

References

Hyperlink	Resource
https://liferay.dev/portal/security/known-vulnerabilities/-/asset_publisher/jekt/content/CVE-2025-43805	N/A

Hyperlink: https://liferay.dev/portal/security/known-vulnerabilities/-/asset_publisher/jekt/content/CVE-2025-43805

Resource: N/A

▼Authorized Data Publishers (ADP)

CISA ADP Vulnrichment

Metrics Other Info

▼National Vulnerability Database (NVD)

nvd.nist.gov

Source:security@liferay.com

Published At:16 Sep, 2025 | 22:15

Updated At:16 Dec, 2025 | 15:05

Date Added	Due Date	Vulnerability Name	Required Action
	N/A

Metrics

Type	Version	Base score	Base severity	Vector
Secondary	4.0	6.9	MEDIUM	CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Primary	3.1	5.3	MEDIUM	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

Type: Secondary

Version: 4.0

Base score: 6.9

Base severity: MEDIUM

Vector:

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Type: Primary

Version: 3.1

Base score: 5.3

Base severity: MEDIUM

Vector:

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

CPE Matches

cpe:2.3:a:liferay:digital_experience_platform:*:*:*:*:*:*:*:*

>>digital_experience_platform>>Versions from 2023.Q3.0(inclusive) to 2023.Q3.5(exclusive)

cpe:2.3:a:liferay:digital_experience_platform:7.3:-:*:*:*:*:*:*

cpe:2.3:a:liferay:digital_experience_platform:7.3:fix_pack_1:*:*:*:*:*:*

cpe:2.3:a:liferay:digital_experience_platform:7.3:fix_pack_2:*:*:*:*:*:*

cpe:2.3:a:liferay:digital_experience_platform:7.3:service_pack_1:*:*:*:*:*:*

cpe:2.3:a:liferay:digital_experience_platform:7.3:service_pack_2:*:*:*:*:*:*

cpe:2.3:a:liferay:digital_experience_platform:7.3:service_pack_3:*:*:*:*:*:*

cpe:2.3:a:liferay:digital_experience_platform:7.3:update1:*:*:*:*:*:*

cpe:2.3:a:liferay:digital_experience_platform:7.3:update10:*:*:*:*:*:*

cpe:2.3:a:liferay:digital_experience_platform:7.3:update11:*:*:*:*:*:*

cpe:2.3:a:liferay:digital_experience_platform:7.3:update12:*:*:*:*:*:*

cpe:2.3:a:liferay:digital_experience_platform:7.3:update13:*:*:*:*:*:*

cpe:2.3:a:liferay:digital_experience_platform:7.3:update14:*:*:*:*:*:*

cpe:2.3:a:liferay:digital_experience_platform:7.3:update15:*:*:*:*:*:*

cpe:2.3:a:liferay:digital_experience_platform:7.3:update16:*:*:*:*:*:*

cpe:2.3:a:liferay:digital_experience_platform:7.3:update17:*:*:*:*:*:*

cpe:2.3:a:liferay:digital_experience_platform:7.3:update18:*:*:*:*:*:*

cpe:2.3:a:liferay:digital_experience_platform:7.3:update19:*:*:*:*:*:*

cpe:2.3:a:liferay:digital_experience_platform:7.3:update2:*:*:*:*:*:*

cpe:2.3:a:liferay:digital_experience_platform:7.3:update20:*:*:*:*:*:*

cpe:2.3:a:liferay:digital_experience_platform:7.3:update21:*:*:*:*:*:*

cpe:2.3:a:liferay:digital_experience_platform:7.3:update22:*:*:*:*:*:*

cpe:2.3:a:liferay:digital_experience_platform:7.3:update23:*:*:*:*:*:*

cpe:2.3:a:liferay:digital_experience_platform:7.3:update24:*:*:*:*:*:*

cpe:2.3:a:liferay:digital_experience_platform:7.3:update25:*:*:*:*:*:*

cpe:2.3:a:liferay:digital_experience_platform:7.3:update26:*:*:*:*:*:*

cpe:2.3:a:liferay:digital_experience_platform:7.3:update27:*:*:*:*:*:*

cpe:2.3:a:liferay:digital_experience_platform:7.3:update28:*:*:*:*:*:*

cpe:2.3:a:liferay:digital_experience_platform:7.3:update29:*:*:*:*:*:*

cpe:2.3:a:liferay:digital_experience_platform:7.3:update3:*:*:*:*:*:*

cpe:2.3:a:liferay:digital_experience_platform:7.3:update30:*:*:*:*:*:*

cpe:2.3:a:liferay:digital_experience_platform:7.3:update31:*:*:*:*:*:*

cpe:2.3:a:liferay:digital_experience_platform:7.3:update32:*:*:*:*:*:*

cpe:2.3:a:liferay:digital_experience_platform:7.3:update33:*:*:*:*:*:*

cpe:2.3:a:liferay:digital_experience_platform:7.3:update34:*:*:*:*:*:*

cpe:2.3:a:liferay:digital_experience_platform:7.3:update35:*:*:*:*:*:*

cpe:2.3:a:liferay:digital_experience_platform:7.3:update4:*:*:*:*:*:*

cpe:2.3:a:liferay:digital_experience_platform:7.3:update5:*:*:*:*:*:*

cpe:2.3:a:liferay:digital_experience_platform:7.3:update6:*:*:*:*:*:*

cpe:2.3:a:liferay:digital_experience_platform:7.3:update7:*:*:*:*:*:*

cpe:2.3:a:liferay:digital_experience_platform:7.3:update8:*:*:*:*:*:*

cpe:2.3:a:liferay:digital_experience_platform:7.3:update9:*:*:*:*:*:*

cpe:2.3:a:liferay:digital_experience_platform:7.4:-:*:*:*:*:*:*

cpe:2.3:a:liferay:digital_experience_platform:7.4:update1:*:*:*:*:*:*

cpe:2.3:a:liferay:digital_experience_platform:7.4:update10:*:*:*:*:*:*

cpe:2.3:a:liferay:digital_experience_platform:7.4:update11:*:*:*:*:*:*

cpe:2.3:a:liferay:digital_experience_platform:7.4:update12:*:*:*:*:*:*

cpe:2.3:a:liferay:digital_experience_platform:7.4:update13:*:*:*:*:*:*

cpe:2.3:a:liferay:digital_experience_platform:7.4:update14:*:*:*:*:*:*

cpe:2.3:a:liferay:digital_experience_platform:7.4:update15:*:*:*:*:*:*

Weaknesses

CWE ID	Type	Source
CWE-862	Secondary	security@liferay.com

CWE ID: CWE-862

Type: Secondary

Source: security@liferay.com

References

Hyperlink	Source	Resource
https://liferay.dev/portal/security/known-vulnerabilities/-/asset_publisher/jekt/content/CVE-2025-43805	security@liferay.com	Vendor Advisory

Hyperlink: https://liferay.dev/portal/security/known-vulnerabilities/-/asset_publisher/jekt/content/CVE-2025-43805

Source: security@liferay.com

Resource:

Vendor Advisory

Similar CVEs

516Records found

CVE-2023-33948

Matching Score-10

Assigner-Liferay, Inc.

Matching Score-10

Assigner-Liferay, Inc.

CVSS Score-5.3||MEDIUM

EPSS-0.33% / 56.29%

7 Day CHG~0.00%

Published-24 May, 2023 | 15:42

Updated-13 Jan, 2026 | 02:55

The Dynamic Data Mapping module in Liferay Portal 7.4.3.67, and Liferay DXP 7.4 update 67 does not limit Document and Media files which can be downloaded from a Form, which allows remote attackers to download any file from Document and Media via a crafted URL.

Vendor-Liferay Inc.

Product-digital_experience_platform liferay_portal DXP Portal

CWE ID-CWE-862

Missing Authorization

CVE-2025-62256

Matching Score-10

Assigner-Liferay, Inc.

Matching Score-10

Assigner-Liferay, Inc.

CVSS Score-6.9||MEDIUM

EPSS-0.02% / 3.79%

7 Day CHG~0.00%

Published-23 Oct, 2025 | 13:41

Updated-10 Nov, 2025 | 22:14

Liferay Portal 7.4.0 through 7.4.3.109, and Liferay DXP 2023.Q4.0 through 2023.Q4.5, 2023.Q3.1 through 2023.Q3.7, 7.4 GA through update 92, 7.3 GA through update 35, and older unsupported versions does not properly restrict access to OpenAPI in certain circumstances, which allows remote attackers to access the OpenAPI YAML file via a crafted URL.

Vendor-Liferay Inc.

Product-digital_experience_platform liferay_portal Portal DXP

CWE ID-CWE-862

Missing Authorization

CVE-2022-25146

Matching Score-8

Assigner-MITRE Corporation

Matching Score-8

Assigner-MITRE Corporation

CVSS Score-5.3||MEDIUM

EPSS-0.14% / 33.60%

7 Day CHG~0.00%

Published-02 Mar, 2022 | 23:28

Updated-03 Aug, 2024 | 04:29

The Remote App module in Liferay Portal Liferay Portal v7.4.3.4 through v7.4.3.8 and Liferay DXP 7.4 before update 5 does not check if the origin of event messages it receives matches the origin of the Remote App, allowing attackers to exfiltrate the CSRF token via a crafted event message.

Vendor-n/a Liferay Inc.

Product-digital_experience_platform liferay_portal n/a

CWE ID-CWE-346

Origin Validation Error

CVE-2025-62257

Matching Score-8

Assigner-Liferay, Inc.

Matching Score-8

Assigner-Liferay, Inc.

CVSS Score-6.3||MEDIUM

EPSS-0.02% / 3.79%

7 Day CHG~0.00%

Published-29 Oct, 2025 | 23:24

Updated-10 Nov, 2025 | 21:37

Password enumeration vulnerability in Liferay Portal 7.4.0 through 7.4.3.119, and older unsupported versions, and Liferay DXP 2024.Q1.1 through 2024.Q1.5, 2023.Q4.0 through 2023.Q4.10, 2023.Q3.1 through 2023.Q3.10, 7.4 GA through update 92, and older unsupported versions allows remote attackers to determine a user’s password even if account lockout is enabled via brute force attack.

Vendor-Liferay Inc.

Product-digital_experience_platform liferay_portal Portal DXP

CWE ID-CWE-307

Improper Restriction of Excessive Authentication Attempts

CVE-2025-62275

Matching Score-8

Assigner-Liferay, Inc.

Matching Score-8

Assigner-Liferay, Inc.

CVSS Score-6.9||MEDIUM

EPSS-0.06% / 17.57%

7 Day CHG~0.00%

Published-01 Nov, 2025 | 02:42

Updated-10 Nov, 2025 | 16:20

Blogs in Liferay Portal 7.4.0 through 7.4.3.111, and older unsupported versions, and Liferay DXP 2023.Q4.0 through 2023.Q4.10, 2023.Q3.1 through 2023.Q3.10, 7.4 GA through update 92, and older unsupported versions does not check permission of images in a blog entry, which allows remote attackers to view the images in a blog entry via crafted URL.

Vendor-Liferay Inc.

Product-digital_experience_platform liferay_portal Portal DXP

CWE ID-CWE-863

Incorrect Authorization

CVE-2021-29040

Matching Score-8

Assigner-MITRE Corporation

Matching Score-8

Assigner-MITRE Corporation

CVSS Score-5.3||MEDIUM

EPSS-0.40% / 61.01%

7 Day CHG~0.00%

Published-16 May, 2021 | 15:03

Updated-13 May, 2025 | 18:17

The JSON web services in Liferay Portal 7.3.4 and earlier, and Liferay DXP 7.0 before fix pack 97, 7.1 before fix pack 20 and 7.2 before fix pack 10 may provide overly verbose error messages, which allows remote attackers to use the contents of error messages to help launch another, more focused attacks via crafted inputs.

Vendor-n/a Liferay Inc.

Product-liferay_portal digital_experience_platform n/a

CWE ID-CWE-209

Generation of Error Message Containing Sensitive Information

CVE-2025-43803

Matching Score-8

Assigner-Liferay, Inc.

Matching Score-8

Assigner-Liferay, Inc.

CVSS Score-6.9||MEDIUM

EPSS-0.05% / 16.48%

7 Day CHG~0.00%

Published-19 Sep, 2025 | 18:50

Updated-16 Dec, 2025 | 16:38

Insecure direct object reference (IDOR) vulnerability in the Contacts Center widget in Liferay Portal 7.4.0 through 7.4.3.119, and older unsupported versions, and Liferay DXP 2023.Q4.0 through 2023.Q4.6, 2023.Q3.1 through 2023.Q3.10, 7.4 GA through update 92, and older unsupported versions allows remote attackers to view contact information, including the contact’s name and email address, via the _com_liferay_contacts_web_portlet_ContactsCenterPortlet_entryId parameter.

Vendor-Liferay Inc.

Product-liferay_portal digital_experience_platform DXP Portal

CWE ID-CWE-639

Authorization Bypass Through User-Controlled Key

CVE-2025-43808

Matching Score-8

Assigner-Liferay, Inc.

Matching Score-8

Assigner-Liferay, Inc.

CVSS Score-6.9||MEDIUM

EPSS-0.02% / 3.94%

7 Day CHG~0.00%

Published-19 Sep, 2025 | 20:37

Updated-15 Dec, 2025 | 18:18

The Commerce component in Liferay Portal 7.3.0 through 7.4.3.112, and Liferay DXP 2023.Q4.0 through 2023.Q4.8, 2023.Q3.1 through 2023.Q3.10, 7.4 GA through update 92, and 7.3 service pack 3 through update 35 saves virtual products uploaded to Documents and Media with guest view permission, which allows remote attackers to access and download virtual products for free via a crafted URL.

Vendor-Liferay Inc.

Product-liferay_portal digital_experience_platform DXP Portal

CWE ID-CWE-732

Incorrect Permission Assignment for Critical Resource

CVE-2025-43786

Matching Score-8

Assigner-Liferay, Inc.

Matching Score-8

Assigner-Liferay, Inc.

CVSS Score-6.9||MEDIUM

EPSS-0.04% / 11.06%

7 Day CHG~0.00%

Published-09 Sep, 2025 | 19:08

Updated-16 Dec, 2025 | 15:11

Enumeration of ERC from object entry in Liferay Portal 7.4.0 through 7.4.3.128, and Liferay DXP 2024.Q3.0 through 2024.Q3.1, 2024.Q2.0 through 2024.Q2.13, 2024.Q1.1 through 2024.Q1.12, 2023.Q4.0 and 7.4 GA through update 92 allow attackers to determine existent ERC in the application by exploit the time response.

Vendor-Liferay Inc.

Product-liferay_portal digital_experience_platform DXP Portal

CWE ID-CWE-203

Observable Discrepancy

CWE ID-CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

CVE-2025-43751

Matching Score-8

Assigner-Liferay, Inc.

Matching Score-8

Assigner-Liferay, Inc.

CVSS Score-6.9||MEDIUM

EPSS-0.08% / 23.86%

7 Day CHG~0.00%

Published-22 Aug, 2025 | 15:58

Updated-18 Dec, 2025 | 14:44

User enumeration vulnerability in Liferay Portal 7.4.0 through 7.4.3.132, and Liferay DXP 2024.Q4.0 through 2024.Q4.7, 2024.Q3.0 through 2024.Q3.13, 2024.Q2.0 through 2024.Q2.13, 2024.Q1.1 through 2024.Q1.14, 2023.Q4.0 through 2023.Q4.10, 2023.Q3.1 through 2023.Q3.10 and 7.4 GA through update 92 allows remote attackers to determine if an account exist in the application via the create account page.

Vendor-Liferay Inc.

Product-digital_experience_platform liferay_portal Portal DXP

CWE ID-CWE-203

Observable Discrepancy

CVE-2020-15840

Matching Score-8

Assigner-MITRE Corporation

Matching Score-8

Assigner-MITRE Corporation

CVSS Score-5.3||MEDIUM

EPSS-0.19% / 41.07%

7 Day CHG~0.00%

Published-24 Sep, 2020 | 14:56

Updated-13 May, 2025 | 18:17

In Liferay Portal before 7.3.1, Liferay Portal 6.2 EE, and Liferay DXP 7.2, DXP 7.1 and DXP 7.0, the property 'portlet.resource.id.banned.paths.regexp' can be bypassed with doubled encoded URLs.

Vendor-n/a Liferay Inc.

Product-liferay_portal digital_experience_platform n/a

CVE-2025-43758

Matching Score-8

Assigner-Liferay, Inc.

Matching Score-8

Assigner-Liferay, Inc.

CVSS Score-5.3||MEDIUM

EPSS-0.12% / 29.95%

7 Day CHG~0.00%

Published-22 Aug, 2025 | 18:18

Updated-16 Dec, 2025 | 14:53

Liferay Portal 7.4.0 through 7.4.3.132, and Liferay DXP 2025.Q1.0 through 2025.Q1.5, 2024.Q4.0 through 2024.Q4.7, 2024.Q3.1 through 2024.Q3.13, 2024.Q2.0 through 2024.Q2.13, 2024.Q1.1 through 2024.Q1.15 and 7.4 GA through update 92 allows unauthenticated users (guests) to access via URL files uploaded by object entry and stored in document_library

Vendor-Liferay Inc.

Product-liferay_portal digital_experience_platform Portal DXP

CWE ID-CWE-552

Files or Directories Accessible to External Parties

CVE-2025-43754

Matching Score-8

Assigner-Liferay, Inc.

Matching Score-8

Assigner-Liferay, Inc.

CVSS Score-6.9||MEDIUM

EPSS-0.08% / 23.13%

7 Day CHG+0.01%

Published-21 Aug, 2025 | 17:10

Updated-12 Dec, 2025 | 20:32

Username enumeration vulnerability in Liferay Portal 7.4.0 through 7.4.3.132, and Liferay DXP 2024.Q4.0 through 2024.Q4.7, 2024.Q3.0 through 2024.Q3.13, 2024.Q2.0 through 2024.Q2.13, 2024.Q1.1 through 2024.Q1.14 and 7.4 GA through update 92 allows attackers to determine if an account exist in the application by inspecting the server processing time of the login request.

Vendor-Liferay Inc.

Product-digital_experience_platform liferay_portal DXP Portal

CWE ID-CWE-208

Observable Timing Discrepancy

CVE-2025-43777

Matching Score-8

Assigner-Liferay, Inc.

Matching Score-8

Assigner-Liferay, Inc.

CVSS Score-5.1||MEDIUM

EPSS-0.04% / 13.33%

7 Day CHG~0.00%

Published-09 Sep, 2025 | 03:00

Updated-12 Dec, 2025 | 20:29

Liferay Portal 7.4.0 through 7.4.3.132, and Liferay DXP 2025.Q2.0 through 2025.Q2.9, 2025.Q1.0 through 2025.Q1.16, 2024.Q4.0 through 2024.Q4.7, 2024.Q3.0 through 2024.Q3.13, 2024.Q2.0 through 2024.Q2.13 and 2024.Q1.1 through 2024.Q1.19 exposes "Internal Server Error" in the response body when a login attempt is made with a deleted Client Secret.

Vendor-Liferay Inc.

Product-digital_experience_platform liferay_portal DXP Portal

CWE ID-CWE-209

Generation of Error Message Containing Sensitive Information

CVE-2024-26267

Matching Score-8

Assigner-Liferay, Inc.

Matching Score-8

Assigner-Liferay, Inc.

CVSS Score-5.3||MEDIUM

EPSS-0.22% / 45.00%

7 Day CHG~0.00%

Published-20 Feb, 2024 | 13:01

Updated-28 Jan, 2025 | 21:36

In Liferay Portal 7.2.0 through 7.4.3.25, and older unsupported versions, and Liferay DXP 7.4 before update 26, 7.3 before update 5, 7.2 before fix pack 19, and older unsupported versions the default value of the portal property `http.header.version.verbosity` is set to `full`, which allows remote attackers to easily identify the version of the application that is running and the vulnerabilities that affect that version via 'Liferay-Portal` response header.

Vendor-Liferay Inc.

Product-liferay_portal digital_experience_platform DXP Portal

CWE ID-CWE-1188

Initialization of a Resource with an Insecure Default

CVE-2024-25146

Matching Score-8

Assigner-Liferay, Inc.

Matching Score-8

Assigner-Liferay, Inc.

CVSS Score-5.3||MEDIUM

EPSS-0.39% / 60.03%

7 Day CHG~0.00%

Published-08 Feb, 2024 | 03:36

Updated-15 May, 2025 | 19:40

Liferay Portal 7.2.0 through 7.4.1, and older unsupported versions, and Liferay DXP 7.3 before service pack 3, 7.2 before fix pack 18, and older unsupported versions returns with different responses depending on whether a site does not exist or if the user does not have permission to access the site, which allows remote attackers to discover the existence of sites by enumerating URLs. This vulnerability occurs if locale.prepend.friendly.url.style=2 and if a custom 404 page is used.

Vendor-Liferay Inc.

Product-liferay_portal dxp digital_experience_platform Portal DXP

CWE ID-CWE-204

Observable Response Discrepancy

CWE ID-CWE-203

Observable Discrepancy

CVE-2022-42127

Matching Score-8

Assigner-MITRE Corporation

Matching Score-8

Assigner-MITRE Corporation

CVSS Score-5.3||MEDIUM

EPSS-0.19% / 40.10%

7 Day CHG~0.00%

Published-15 Nov, 2022 | 00:00

Updated-30 Apr, 2025 | 15:15

The Friendly Url module in Liferay Portal 7.4.3.5 through 7.4.3.36, and Liferay DXP 7.4 update 1 though 36 does not properly check user permissions, which allows remote attackers to obtain the history of all friendly URLs that was assigned to a page.

Vendor-n/a Liferay Inc.

Product-liferay_portal digital_experience_platform n/a

CWE ID-CWE-276

Incorrect Default Permissions

CVE-2024-26268

Matching Score-8

Assigner-Liferay, Inc.

Matching Score-8

Assigner-Liferay, Inc.

CVSS Score-5.3||MEDIUM

EPSS-0.30% / 53.79%

7 Day CHG~0.00%

Published-20 Feb, 2024 | 13:17

Updated-28 Jan, 2025 | 21:37

User enumeration vulnerability in Liferay Portal 7.2.0 through 7.4.3.26, and older unsupported versions, and Liferay DXP 7.4 before update 27, 7.3 before update 8, 7.2 before fix pack 20, and older unsupported versions allows remote attackers to determine if an account exist in the application by comparing the request's response time.

Vendor-ibexa Liferay Inc.

Product-liferay_portal digital_experience_platform DXP Portal digital_experience_platform liferay_enterprise_portal

CWE ID-CWE-203

Observable Discrepancy

CVE-2024-25605

Matching Score-8

Assigner-Liferay, Inc.

Matching Score-8

Assigner-Liferay, Inc.

CVSS Score-5.3||MEDIUM

EPSS-0.19% / 40.10%

7 Day CHG~0.00%

Published-20 Feb, 2024 | 08:51

Updated-24 Apr, 2025 | 15:05

The Journal module in Liferay Portal 7.2.0 through 7.4.3.4, and older unsupported versions, and Liferay DXP 7.4.13, 7.3 before service pack 3, 7.2 before fix pack 17, and older unsupported versions grants guest users view permission to web content templates by default, which allows remote attackers to view any template via the UI or API.

Vendor-Liferay Inc.

Product-digital_experience_platform liferay_portal Portal DXP dxp portal

CWE ID-CWE-276

Incorrect Default Permissions

CVE-2022-41414

Matching Score-8

Assigner-MITRE Corporation

Matching Score-8

Assigner-MITRE Corporation

CVSS Score-5.3||MEDIUM

EPSS-0.21% / 42.56%

7 Day CHG~0.00%

Published-07 Oct, 2022 | 00:00

Updated-03 Aug, 2024 | 12:42

An insecure default in the component auth.login.prompt.enabled of Liferay Portal v7.0.0 through v7.4.2 allows attackers to enumerate usernames, site names, and pages.

Vendor-n/a Liferay Inc.

Product-liferay_portal n/a

CWE ID-CWE-276

Incorrect Default Permissions

CVE-2022-42128

Matching Score-8

Assigner-MITRE Corporation

Matching Score-8

Assigner-MITRE Corporation

CVSS Score-5.3||MEDIUM

EPSS-0.19% / 40.10%

7 Day CHG~0.00%

Published-15 Nov, 2022 | 00:00

Updated-30 Apr, 2025 | 15:15

The Hypermedia REST APIs module in Liferay Portal 7.4.1 through 7.4.3.4, and Liferay DXP 7.4 GA does not properly check permissions, which allows remote attackers to obtain a WikiNode object via the WikiNodeResource.getSiteWikiNodeByExternalReferenceCode API.

Vendor-n/a Liferay Inc.

Product-liferay_portal digital_experience_platform n/a

CWE ID-CWE-276

Incorrect Default Permissions

CVE-2025-43749

Matching Score-8

Assigner-Liferay, Inc.

Matching Score-8

Assigner-Liferay, Inc.

CVSS Score-5.3||MEDIUM

EPSS-0.13% / 31.94%

7 Day CHG+0.01%

Published-20 Aug, 2025 | 12:32

Updated-16 Dec, 2025 | 14:47

Liferay Portal 7.4.0 through 7.4.3.132, and Liferay DXP 2025.Q1.0 through 2025.Q1.1, 2024.Q4.0 through 2024.Q4.7, 2024.Q3.1 through 2024.Q3.13, 2024.Q2.0 through 2024.Q2.13, 2024.Q1.1 through 2024.Q1.14 and 7.4 GA through update 92 allows unauthenticated users (guests) to access via URL files uploaded in the form and stored in document_library

Vendor-Liferay Inc.

Product-liferay_portal digital_experience_platform DXP Portal

CWE ID-CWE-552

Files or Directories Accessible to External Parties

CVE-2023-3426

Matching Score-6

Assigner-Liferay, Inc.

Matching Score-6

Assigner-Liferay, Inc.

CVSS Score-4.3||MEDIUM

EPSS-0.40% / 61.20%

7 Day CHG~0.00%

Published-02 Aug, 2023 | 09:40

Updated-30 Jan, 2026 | 20:43

The organization selector in Liferay Portal 7.4.3.81 through 7.4.3.85, and Liferay DXP 7.4 update 81 through 85 does not check user permission, which allows remote authenticated users to obtain a list of all organizations.

Vendor-Liferay Inc.

Product-digital_experience_platform liferay_portal DXP Portal

CWE ID-CWE-425

Direct Request ('Forced Browsing')

CWE ID-CWE-862

Missing Authorization

CVE-2025-43773

Matching Score-6

Assigner-Liferay, Inc.

Matching Score-6

Assigner-Liferay, Inc.

CVSS Score-4.6||MEDIUM

EPSS-0.07% / 21.44%

7 Day CHG+0.02%

Published-29 Aug, 2025 | 18:59

Updated-16 Dec, 2025 | 14:56

Liferay Portal 7.4.0 through 7.4.3.132, and Liferay DXP 2025.Q2.0, 2025.Q1.0 through 2025.Q1.14, 2024.Q4.0 through 2024.Q4.7, 2024.Q3.0 through 2024.Q3.13, 2024.Q2.0 through 2024.Q2.13, 2024.Q1.1 through 2024.Q1.18 and 7.4 GA through update 92 has a security vulnerability that allowing for improper access through the expandoTableLocalService.

Vendor-Liferay Inc.

Product-liferay_portal digital_experience_platform DXP Portal

CWE ID-CWE-862

Missing Authorization

CVE-2025-62247

Matching Score-6

Assigner-Liferay, Inc.

Matching Score-6

Assigner-Liferay, Inc.

CVSS Score-2||LOW

EPSS-0.04% / 13.43%

7 Day CHG~0.00%

Published-22 Oct, 2025 | 19:27

Updated-11 Dec, 2025 | 18:13

Missing Authorization in Collection Provider component in the Liferay Portal 7.4.0 through 7.4.3.132, and Liferay DXP 2025.Q2.0 through 2025.Q2.9, 2025.Q1.0 through 2025.Q1.16, 2024.Q4.0 through 2024.Q4.7, 2024.Q3.1 through 2024.Q3.13, 2024.Q2.0 through 2024.Q2.13, 2024.Q1.1 through 2024.Q1.19 allows instance users to read and select unauthorized Blueprints through the Collection Providers across instances.

Vendor-Liferay Inc.

Product-digital_experience_platform liferay_portal Portal DXP

CWE ID-CWE-862

Missing Authorization

CVE-2024-38002

Matching Score-6

Assigner-Liferay, Inc.

Matching Score-6

Assigner-Liferay, Inc.

CVSS Score-9||CRITICAL

EPSS-4.28% / 88.94%

7 Day CHG~0.00%

Published-22 Oct, 2024 | 15:12

Updated-13 Oct, 2025 | 19:15

The workflow component in Liferay Portal 7.3.2 through 7.4.3.111, and Liferay DXP 2023.Q4.0 through 2023.Q4.5, 2023.Q3.1 through 2023.Q3.8, 7.4 GA through update 92 and 7.3 GA through update 36 does not properly check user permissions before updating a workflow definition, which allows remote authenticated users to modify workflow definitions and execute arbitrary code (RCE) via the headless API.

Vendor-Liferay Inc.

Product-digital_experience_platform liferay_portal Portal DXP portal dxp

CWE ID-CWE-862

Missing Authorization

CWE ID-CWE-863

Incorrect Authorization

CVE-2025-43788

Matching Score-6

Assigner-Liferay, Inc.

Matching Score-6

Assigner-Liferay, Inc.

CVSS Score-5.3||MEDIUM

EPSS-0.05% / 16.06%

7 Day CHG~0.00%

Published-12 Sep, 2025 | 02:22

Updated-16 Dec, 2025 | 15:13

The organization selector in Liferay Portal 7.4.0 through 7.4.3.124, and Liferay DXP 2024.Q1.1 through 2024.Q1.12 and 7.4 update 81 through update 85 does not check user permission, which allows remote authenticated users to obtain a list of all organizations.

Vendor-Liferay Inc.

Product-liferay_portal digital_experience_platform DXP Portal

CWE ID-CWE-862

Missing Authorization

CVE-2022-39975

Matching Score-6

Assigner-MITRE Corporation

Matching Score-6

Assigner-MITRE Corporation

CVSS Score-4.3||MEDIUM

EPSS-0.16% / 36.14%

7 Day CHG~0.00%

Published-21 Sep, 2022 | 23:35

Updated-27 May, 2025 | 19:15

The Layout module in Liferay Portal v7.3.3 through v7.4.3.34, and Liferay DXP 7.3 before update 10, and 7.4 before update 35 does not check user permission before showing the preview of a "Content Page" type page, allowing attackers to view unpublished "Content Page" pages via URL manipulation.

Vendor-n/a Liferay Inc.

Product-dxp liferay_portal n/a

CWE ID-CWE-862

Missing Authorization

CVE-2022-38512

Matching Score-6

Assigner-MITRE Corporation

Matching Score-6

Assigner-MITRE Corporation

CVSS Score-6.5||MEDIUM

EPSS-0.22% / 44.55%

7 Day CHG~0.00%

Published-22 Sep, 2022 | 00:17

Updated-27 May, 2025 | 18:15

The Translation module in Liferay Portal v7.4.3.12 through v7.4.3.36, and Liferay DXP 7.4 update 8 through 36 does not check permissions before allowing a user to export a web content for translation, allowing attackers to download a web content page's XLIFF translation file via crafted URL.

Vendor-n/a Liferay Inc.

Product-dxp liferay_portal n/a

CWE ID-CWE-862

Missing Authorization

CVE-2020-13445

Matching Score-6

Assigner-MITRE Corporation

Matching Score-6

Assigner-MITRE Corporation

CVSS Score-8.8||HIGH

EPSS-3.71% / 88.09%

7 Day CHG~0.00%

Published-10 Jun, 2020 | 18:09

Updated-04 Aug, 2024 | 12:18

In Liferay Portal before 7.3.2 and Liferay DXP 7.0 before fix pack 92, 7.1 before fix pack 18, and 7.2 before fix pack 6, the template API does not restrict user access to sensitive objects, which allows remote authenticated users to execute arbitrary code via crafted FreeMarker and Velocity templates.

Vendor-n/a Liferay Inc.

Product-liferay_portal n/a

CWE ID-CWE-862

Missing Authorization

CWE ID-CWE-74

Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection')

CVE-2026-31916

Matching Score-4

Assigner-Patchstack

Matching Score-4

Assigner-Patchstack

CVSS Score-5.3||MEDIUM

EPSS-0.04% / 12.33%

7 Day CHG~0.00%

Published-13 Mar, 2026 | 11:41

Updated-29 Apr, 2026 | 10:16

WordPress Latest Post Shortcode plugin <= 14.2.1 - Broken Access Control vulnerability

Missing Authorization vulnerability in Iulia Cazan Latest Post Shortcode latest-post-shortcode allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Latest Post Shortcode: from n/a through <= 14.2.1.

Vendor-Iulia Cazan

Product-Latest Post Shortcode

CWE ID-CWE-862

Missing Authorization

CVE-2023-6496

Matching Score-4

Assigner-Wordfence

Matching Score-4

Assigner-Wordfence

CVSS Score-5.3||MEDIUM

EPSS-0.41% / 61.52%

7 Day CHG~0.00%

Published-11 Jan, 2024 | 08:32

Updated-08 Apr, 2026 | 17:17

Manage Notification E-mails <= 1.8.5 - Missing Authorization

The Manage Notification E-mails plugin for WordPress is vulnerable to Missing Authorization in all versions up to, and including, 1.8.5 via the card_famne_export_settings function. This makes it possible for unauthenticated attackers to obtain plugin settings.

Vendor-freeamigos virgial

Product-manage_notification_e-mails Manage Notification E-mails

CWE ID-CWE-285

Improper Authorization

CWE ID-CWE-862

Missing Authorization

CVE-2026-32413

Matching Score-4

Assigner-Patchstack

Matching Score-4

Assigner-Patchstack

CVSS Score-5.3||MEDIUM

EPSS-0.04% / 12.33%

7 Day CHG~0.00%

Published-13 Mar, 2026 | 11:42

Updated-29 Apr, 2026 | 10:17

WordPress Permalink Manager Lite plugin < 2.5.3 - Broken Access Control vulnerability

Missing Authorization vulnerability in Maciej Bis Permalink Manager Lite permalink-manager allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Permalink Manager Lite: from n/a through < 2.5.3.

Vendor-Maciej Bis

Product-Permalink Manager Lite

CWE ID-CWE-862

Missing Authorization

CVE-2026-32332

Matching Score-4

Assigner-Patchstack

Matching Score-4

Assigner-Patchstack

CVSS Score-5.3||MEDIUM

EPSS-0.04% / 12.33%

7 Day CHG~0.00%

Published-13 Mar, 2026 | 11:41

Updated-29 Apr, 2026 | 10:16

WordPress Easy Form plugin <= 2.7.9 - Broken Access Control vulnerability

Missing Authorization vulnerability in Ays Pro Easy Form easy-form allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Easy Form: from n/a through <= 2.7.9.

Vendor-AYS Pro Extensions

Product-Easy Form

CWE ID-CWE-862

Missing Authorization

CVE-2025-30592

Matching Score-4

Assigner-Patchstack

Matching Score-4

Assigner-Patchstack

CVSS Score-5.3||MEDIUM

EPSS-0.27% / 51.05%

7 Day CHG~0.00%

Published-24 Mar, 2025 | 13:47

Updated-28 Apr, 2026 | 16:11

WordPress Advanced Dewplayer - plugin <= 1.6 Broken Access Control Vulnerability

Missing Authorization vulnerability in WesternDeal Advanced Dewplayer advanced-dewplayer allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Advanced Dewplayer: from n/a through <= 1.6.

Vendor-WesternDeal

Product-Advanced Dewplayer

CWE ID-CWE-862

Missing Authorization

CVE-2026-32404

Matching Score-4

Assigner-Patchstack

Matching Score-4

Assigner-Patchstack

CVSS Score-5.3||MEDIUM

EPSS-0.04% / 12.33%

7 Day CHG~0.00%

Published-13 Mar, 2026 | 11:42

Updated-29 Apr, 2026 | 10:17

WordPress Studio99 WP Monitor plugin <= 1.0.3 - Broken Access Control vulnerability

Missing Authorization vulnerability in Studio99 Studio99 WP Monitor studio99-wp-monitor allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Studio99 WP Monitor: from n/a through <= 1.0.3.

Vendor-Studio99

Product-Studio99 WP Monitor

CWE ID-CWE-862

Missing Authorization

CVE-2023-6325

Matching Score-4

Assigner-Wordfence

Matching Score-4

Assigner-Wordfence

CVSS Score-5.3||MEDIUM

EPSS-0.73% / 72.77%

7 Day CHG~0.00%

Published-23 May, 2024 | 04:30

Updated-15 Apr, 2026 | 00:35

RomethemeForm For Elementor <= 1.1.5 - Missing Authorization via export_entries, rtformnewform, and rtformupdate

The RomethemeForm For Elementor plugin for WordPress is vulnerable to unauthorized access and modification of data due to a missing capability check on the export_entries, rtformnewform, and rtformupdate functions in all versions up to, and including, 1.1.5. This makes it possible for unauthenticated attackers to export arbitrary form submissions, create new forms, or update any post title or certain metadata.

Vendor-rometheme rometheme

Product-RTMForm Builder romethemeform_for_elementor

CWE ID-CWE-862

Missing Authorization

CVE-2026-32409

Matching Score-4

Assigner-Patchstack

Matching Score-4

Assigner-Patchstack

CVSS Score-5.3||MEDIUM

EPSS-0.04% / 12.33%

7 Day CHG~0.00%

Published-13 Mar, 2026 | 11:42

Updated-29 Apr, 2026 | 10:17

WordPress Forminator plugin <= 1.50.2 - Broken Access Control vulnerability

Missing Authorization vulnerability in WPMU DEV - Your All-in-One WordPress Platform Forminator forminator allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Forminator: from n/a through <= 1.50.2.

Vendor-WPMU DEV - Your All-in-One WordPress Platform

Product-Forminator

CWE ID-CWE-862

Missing Authorization

CVE-2026-32395

Matching Score-4

Assigner-Patchstack

Matching Score-4

Assigner-Patchstack

CVSS Score-5.3||MEDIUM

EPSS-0.04% / 12.33%

7 Day CHG~0.00%

Published-13 Mar, 2026 | 11:42

Updated-29 Apr, 2026 | 10:17

WordPress Xpro Addons For Beaver Builder – Lite plugin <= 1.5.6 - Broken Access Control vulnerability

Missing Authorization vulnerability in Xpro Xpro Addons For Beaver Builder – Lite xpro-addons-beaver-builder-elementor allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Xpro Addons For Beaver Builder – Lite: from n/a through <= 1.5.6.

Vendor-Xpro

Product-Xpro Addons For Beaver Builder – Lite

CWE ID-CWE-862

Missing Authorization

CVE-2026-32410

Matching Score-4

Assigner-Patchstack

Matching Score-4

Assigner-Patchstack

CVSS Score-5.3||MEDIUM

EPSS-0.04% / 12.33%

7 Day CHG~0.00%

Published-13 Mar, 2026 | 11:42

Updated-29 Apr, 2026 | 10:17

WordPress WBW Currency Switcher for WooCommerce plugin <= 2.2.5 - Broken Access Control vulnerability

Missing Authorization vulnerability in WBW Plugins WBW Currency Switcher for WooCommerce woo-currency allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects WBW Currency Switcher for WooCommerce: from n/a through <= 2.2.5.

Vendor-WBW Plugins

Product-WBW Currency Switcher for WooCommerce

CWE ID-CWE-862

Missing Authorization

CVE-2026-32396

Matching Score-4

Assigner-Patchstack

Matching Score-4

Assigner-Patchstack

CVSS Score-5.3||MEDIUM

EPSS-0.04% / 12.33%

7 Day CHG~0.00%

Published-13 Mar, 2026 | 11:42

Updated-29 Apr, 2026 | 10:17

WordPress Team plugin <= 5.0.13 - Broken Access Control vulnerability

Missing Authorization vulnerability in RadiusTheme Team tlp-team allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Team: from n/a through <= 5.0.13.

Vendor-RadiusTheme

Product-Team

CWE ID-CWE-862

Missing Authorization

CVE-2023-6785

Matching Score-4

Assigner-Wordfence

Matching Score-4

Assigner-Wordfence

CVSS Score-5.3||MEDIUM

EPSS-0.39% / 60.27%

7 Day CHG~0.00%

Published-13 Mar, 2024 | 15:26

Updated-08 Apr, 2026 | 18:18

Download Manager <= 3.2.84 - Missing Authorization

The Download Manager plugin for WordPress is vulnerable to unauthorized file download of files added via the plugin in all versions up to, and including, 3.2.84. This makes it possible for unauthenticated attackers to download files added with the plugin (even when privately published).

Vendor-WordPress Download Manager Pro W3 Eden, Inc.Shahjada (codename065)

Product-download_manager Download Manager

CWE ID-CWE-284

Improper Access Control

CWE ID-CWE-862

Missing Authorization

CVE-2026-32397

Matching Score-4

Assigner-Patchstack

Matching Score-4

Assigner-Patchstack

CVSS Score-5.3||MEDIUM

EPSS-0.04% / 12.33%

7 Day CHG~0.00%

Published-13 Mar, 2026 | 11:42

Updated-29 Apr, 2026 | 10:17

WordPress Filter & Grids plugin <= 3.5.1 - Broken Access Control vulnerability

Missing Authorization vulnerability in YMC Filter & Grids ymc-smart-filter allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Filter & Grids: from n/a through <= 3.5.1.

Vendor-YMC

Product-Filter & Grids

CWE ID-CWE-862

Missing Authorization

CVE-2026-31915

Matching Score-4

Assigner-Patchstack

Matching Score-4

Assigner-Patchstack

CVSS Score-5.3||MEDIUM

EPSS-0.01% / 2.14%

7 Day CHG~0.00%

Published-13 Mar, 2026 | 11:41

Updated-29 Apr, 2026 | 10:16

WordPress Flatsome theme <= 3.19.6 - Broken Access Control vulnerability

Missing Authorization vulnerability in UX-themes Flatsome flatsome allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Flatsome: from n/a through <= 3.19.6.

Vendor-UX-themes

Product-Flatsome

CWE ID-CWE-862

Missing Authorization

CVE-2024-12184

Matching Score-4

Assigner-Wordfence

Matching Score-4

Assigner-Wordfence

CVSS Score-5.3||MEDIUM

EPSS-0.39% / 60.49%

7 Day CHG~0.00%

Published-01 Feb, 2025 | 03:21

Updated-08 Apr, 2026 | 16:58

WordPress Contact Forms by Cimatti <= 1.9.4 - Missing Authorization to Unauthenticated Form Submission Download

The WordPress Contact Forms by Cimatti plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the accua_forms_download_submitted_file() function in all versions up to, and including, 1.9.4. This makes it possible for unauthenticated attackers to download other user submitted forms.

Vendor-cimatti cimatti

Product-wordpress_contact_forms Contact Forms by Cimatti

CWE ID-CWE-862

Missing Authorization

CVE-2026-3208

Matching Score-4

Assigner-Wordfence

Matching Score-4

Assigner-Wordfence

CVSS Score-5.3||MEDIUM

EPSS-0.02% / 4.58%

7 Day CHG~0.00%

Published-06 May, 2026 | 03:27

Updated-06 May, 2026 | 13:06

Mercado Pago payments for WooCommerce <= 8.7.11 - Missing Authorization to Unauthenticated PIX Payment QR Code Image Disclosure

The Mercado Pago payments for WooCommerce plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the 'mp_pix_image' WooCommerce API endpoint in all versions up to, and including, 8.7.11. This makes it possible for unauthenticated attackers to retrieve PIX payment QR code images for arbitrary orders. PIX QR codes contain sensitive merchant information including PIX keys (which may be CPF/CNPJ personal identifiers), transaction amounts, merchant name and city, and MercadoPago transaction references.

Vendor-mercadopago

Product-Mercado Pago payments for WooCommerce

CWE ID-CWE-862

Missing Authorization

CVE-2023-5612

Matching Score-4

Assigner-GitLab Inc.

Matching Score-4

Assigner-GitLab Inc.

CVSS Score-5.3||MEDIUM

EPSS-25.62% / 96.30%

7 Day CHG~0.00%

Published-26 Jan, 2024 | 02:02

Updated-20 Nov, 2025 | 04:10

Missing Authorization in GitLab

An issue has been discovered in GitLab affecting all versions before 16.6.6, 16.7 prior to 16.7.4, and 16.8 prior to 16.8.1. It was possible to read the user email address via tags feed although the visibility in the user profile has been disabled.

Vendor-GitLab Inc.

Product-gitlab GitLab gitlab

CWE ID-CWE-862

Missing Authorization

CVE-2026-32230

Matching Score-4

Assigner-GitHub, Inc.

Matching Score-4

Assigner-GitHub, Inc.

CVSS Score-5.3||MEDIUM

EPSS-0.05% / 16.16%

7 Day CHG~0.00%

Published-12 Mar, 2026 | 18:13

Updated-19 Mar, 2026 | 21:06

Uptime Kuma is Missing Authorization Checks on Ping Badge Endpoint, Leaks Ping times of monitors without needing to be on a status page

Uptime Kuma is an open source, self-hosted monitoring tool. From 2.0.0 to 2.1.3 , the GET /api/badge/:id/ping/:duration? endpoint in server/routers/api-router.js does not verify that the requested monitor belongs to a public group. All other badge endpoints check AND public = 1 in their SQL query before returning data. The ping endpoint skips this check entirely, allowing unauthenticated users to extract average ping/response time data for private monitors. This vulnerability is fixed in 2.2.0.

Vendor-uptime.kuma louislam

Product-uptime_kuma uptime-kuma

CWE ID-CWE-862

Missing Authorization

CVE-2026-32565

Matching Score-4

Assigner-Patchstack

Matching Score-4

Assigner-Patchstack

CVSS Score-5.3||MEDIUM

EPSS-0.04% / 12.33%

7 Day CHG~0.00%

Published-18 Mar, 2026 | 09:31

Updated-29 Apr, 2026 | 10:17

WordPress Contextual Related Posts plugin < 4.2.2 - Broken Access Control vulnerability

Missing Authorization vulnerability in Ajay Contextual Related Posts contextual-related-posts allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Contextual Related Posts: from n/a through < 4.2.2.

Vendor-Ajay

Product-Contextual Related Posts

CWE ID-CWE-862

Missing Authorization

CVE-2026-32421

Matching Score-4

Assigner-Patchstack