MEDIUM6.3
GHSA-vmgw-24w6-9v82
Clickstorm SEO Allows Cross-Site Scripting (XSS)
Quick fix
GHSA-vmgw-24w6-9v82 — clickstorm/cs-seo: upgrade to the fixed version with the command below.
composer require clickstorm/cs-seo:^9.2.0Details
A cross-site scripting (XSS) vulnerability has been discovered in the Clickstorm SEO extension. This vulnerabily is exploitable by a logged in backend user utilizing the TYPO3 backend user interface. This user can create output in the HTML context by exploiting improperly encoded user input. Updates 6.7.0, 7.4.0, 8.3.0 and 9.2.0 are available for download.
Are you affected?
Enter the version of the package you're using.
Affected packages
Packagist/clickstorm/cs-seo
Introduced in:
9.0.0Fixed in: 9.2.0Fix
composer require clickstorm/cs-seo:^9.2.0Packagist/clickstorm/cs-seo
Introduced in:
8.0.0Fixed in: 8.3.0Fix
composer require clickstorm/cs-seo:^8.3.0Packagist/clickstorm/cs-seo
Introduced in:
7.0.0Fixed in: 7.4.0Fix
composer require clickstorm/cs-seo:^7.4.0Packagist/clickstorm/cs-seo
Introduced in:
6.0.0Fixed in: 6.7.0Fix
composer require clickstorm/cs-seo:^6.7.0References
- https://github.com/clickstorm/cs_seo/commit/46e15a22d52da227b110bf6e95c2bcbb2fe4f55f[WEB]
- https://github.com/FriendsOfPHP/security-advisories/blob/master/clickstorm/cs-seo/CVE-2025-30081.yaml[WEB]
- https://github.com/clickstorm/cs_seo[PACKAGE]
- https://typo3.org/security/advisory/typo3-ext-sa-2025-003[WEB]