CVE-2025-43734: Liferay Portal 7.4.0 and Liferay DXP have a reflected cross-site scripting (XSS) vulnerability

The vulnerability exists in the ButtonTag.java file, specifically within the writeLabel method. The vulnerability description highlights that a malicious payload injected into the 'first display label' field of a custom sort widget is executed by the clay button taglib. The provided commit patch confirms this. The patch modifies the writeLabel method to include HTML escaping using HtmlUtil.escape() on the _label variable before it is written to the page. This prevents the browser from interpreting any injected script as executable code. The vulnerable function, com.liferay.frontend.taglib.clay.servlet.taglib.ButtonTag.writeLabel, is therefore the key indicator of this vulnerability in a runtime profile, as it's the exact location where the unsanitized user input is rendered.