A Cross-site Scripting (XSS) vulnerability exists in the Search widget of Liferay Portal versions 7.4.3.93 through 7.4.3.111 and Liferay DXP 2023.Q4.0, 2023.Q3.1 through 2023.Q3.4. This flaw allows remote attackers to inject arbitrary web scripts or HTML via a specific userId parameter. The vulnerability is fixed in version 8.0.93.