GitHub Advisoryadvisory · Packagist

GHSA-vmgw-24w6-9v82 Clickstorm SEO Allows Cross-Site Scripting (XSS)

MEDIUM Published 2025-03-19 Modified 2025-03-19 Official page ↗
Aliases
CVE-2025-30081
Ecosystem
Packagist
Packages
clickstorm/cs-seo
Severity
Moderate
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L/E:F/RL:O/RC:C
Weaknesses
CWE-79
Reviewed
2025-03-19

Affected packages

• Packagist clickstorm/cs-seo: >= 9.0.0, < 9.2.0 → fixed in 9.2.0 • Packagist clickstorm/cs-seo: >= 8.0.0, < 8.3.0 → fixed in 8.3.0 • Packagist clickstorm/cs-seo: >= 7.0.0, < 7.4.0 → fixed in 7.4.0 • Packagist clickstorm/cs-seo: >= 6.0.0, < 6.7.0 → fixed in 6.7.0

Description

A cross-site scripting (XSS) vulnerability has been discovered in the Clickstorm SEO extension. This vulnerabily is exploitable by a logged in backend user utilizing the TYPO3 backend user interface. This user can create output in the HTML context by exploiting improperly encoded user input. Updates 6.7.0, 7.4.0, 8.3.0 and 9.2.0 are available for download.

Related

Alias · not in database (1)

Weakness · CWE (1)

  • CWE-79 Improper Neutralization of Input During Web Page Generation weakness

References