In Liferay Portal before 7.1 CE GA4 an XSS vulnerability exists in the SimpleCaptcha API when custom code passes unsanitized input into the \url\ parameter of the JSP taglib call <liferay-ui:captcha url=\<%= url %>\ /> or <liferay-captcha:captcha url=\<%= url %>\ />. Liferay Portal out-of-the-box behavior with no customizations is not vulnerable.