GitHub Advisoryadvisory · Packagist

GHSA-6p8w-pc35-mqv8 [clickstorm] SEO (cs_seo) TYPO3 extension Cross-site Scripting (XSS) vulnerability

MEDIUM Published 2025-05-21 Modified 2025-05-21 Official page ↗
Aliases
CVE-2025-48203
Ecosystem
Packagist
Packages
clickstorm/cs-seo
Severity
Moderate
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:L/E:F/RL:O/RC:C
Weaknesses
CWE-79
Reviewed
2025-05-21

Affected packages

• Packagist clickstorm/cs-seo: >= 9.0.0, < 9.3.0 → fixed in 9.3.0 • Packagist clickstorm/cs-seo: >= 8.0.0, < 8.4.0 → fixed in 8.4.0 • Packagist clickstorm/cs-seo: >= 7.0.0, < 7.5.0 → fixed in 7.5.0 • Packagist clickstorm/cs-seo: >= 6.3.0, < 6.8.0 → fixed in 6.8.0

Description

Cross-site scripting (XSS) vulnerability in the [clickstorm] SEO (cs_seo) TYPO3 extension allows backend users to execute arbitrary script via the JSON-LD output.

Related

Alias · CVE (1)

  • CVE-2025-48203 The cs_seo extension through 9.2.0 for TYPO3 allows XSS. vulnerability

Weakness · CWE (1)

  • CWE-79 Improper Neutralization of Input During Web Page Generation weakness

References