CVE-2025-4576: Liferay Portal Reflected XSS in blogs-web

The analysis of the provided commit afd9e7751fff6f573699ef1169da279957f72428 clearly indicates a reflected XSS vulnerability in the entry_cover_image_caption.jsp file. The patch itself demonstrates the vulnerability and the fix. The vulnerable code is within a JSP scriptlet, which means the JSP itself is the vulnerable component. The coverImageURL parameter, which is user-controllable, was being directly embedded into a CSS url() function within a style attribute. This allows an attacker to break out of the url() context and inject arbitrary HTML and JavaScript. The fix involves using HtmlUtil.escapeAttribute() to properly sanitize the coverImageURL parameter, preventing the injection of malicious code. Therefore, the identified vulnerable function is the JSP file itself, as it contains the code that processes and renders the malicious input.