Liferay Portal versions 7.4.0 through 7.4.3.111 and certain older unsupported versions, as well as specific Liferay DXP releases, contain a cross-site scripting (XSS) vulnerability in the Blogs widget. This flaw allows remote attackers to inject arbitrary web scripts or HTML via a crafted <iframe> in a blog entry's content. The vulnerability arises because the Blogs widget does not add the sandbox attribute to <iframe> elements, enabling scripts in the iframe to access the parent page. A fix is available in version 7.4.3.112-ga112.