CVE-2025-30081
Clickstorm SEO Allows Cross-Site Scripting (XSS)
A cross-site scripting (XSS) vulnerability has been discovered in the Clickstorm SEO extension. This vulnerabily is exploitable by a logged in backend user utilizing the TYPO3 backend user interface. This user can create output in the HTML context by exploiting improperly encoded user input. Updates 6.7.0, 7.4.0, 8.3.0 and 9.2.0 are available for download.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- Low
- User interaction
- None
What an attacker can affect
- Confidentiality
- Low
- Integrity
- Low
- Availability
- Low
What each source reports
GitHub Advisories Score usedGHSA-vmgw-24w6-9v82
Clickstorm SEO Allows Cross-Site Scripting (XSS)
A cross-site scripting (XSS) vulnerability has been discovered in the Clickstorm SEO extension. This vulnerabily is exploitable by a logged in backend user utilizing the TYPO3 backend user interface. This user can create output in the HTML context by exploiting improperly encoded user input. Updates 6.7.0, 7.4.0, 8.3.0 and 9.2.0 are available for download.
- Record
GHSA-vmgw-24w6-9v82- CVSS 3.1
- 5.9 Medium
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L/E:F/RL:O/RC:C - Weakness
- CWE-79
- Updated
- 2026-11-02
OSVGHSA-vmgw-24w6-9v82
Clickstorm SEO Allows Cross-Site Scripting (XSS)
A cross-site scripting (XSS) vulnerability has been discovered in the Clickstorm SEO extension. This vulnerabily is exploitable by a logged in backend user utilizing the TYPO3 backend user interface. This user can create output in the HTML context by exploiting improperly encoded user input. Updates 6.7.0, 7.4.0, 8.3.0 and 9.2.0 are available for download.
- Record
GHSA-vmgw-24w6-9v82- CVSS 3.1
- 6.3 Medium
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L/E:F/RL:O/RC:C - Weakness
- CWE-79
- Updated
- 2026-11-02
Affected packages
| Package | Affected | Fixed |
|---|---|---|
clickstorm/cs-seoPackagist |
9.0.0 up to 9.2.0 | 9.2.0 |
clickstorm/cs-seoPackagist |
8.0.0 up to 8.3.0 | 8.3.0 |
clickstorm/cs-seoPackagist |
7.0.0 up to 7.4.0 | 7.4.0 |
clickstorm/cs-seoPackagist |
6.0.0 up to 6.7.0 | 6.7.0 |
clickstorm/cs-seoPackagist |
9.0.0 up to 9.2.0, plus listed versions 9.0.19.1.0 |
9.2.0 |
clickstorm/cs-seoPackagist |
8.0.0 up to 8.3.0, plus listed versions 8.0.18.1.08.1.18.1.28.2.08.2.1 |
8.3.0 |
clickstorm/cs-seoPackagist |
7.0.0 up to 7.4.0, plus listed versions 7.0.17.1.07.2.07.2.17.3.07.3.17.3.27.3.3 |
7.4.0 |
clickstorm/cs-seoPackagist |
6.0.0 up to 6.7.0, plus listed versions 6.1.06.1.16.2.06.2.16.3.0 Show 6 moreShow less6.3.16.3.26.4.06.4.16.5.06.6.0 |
6.7.0 |
History
| Recorded | Changed | Sources |
|---|---|---|
| first indexed | GitHub Advisories, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2025-30081 is a medium vulnerability (CVSS 5.9) in clickstorm/cs-seo, published March 19, 2025. No source lists public exploit code. Fixed in clickstorm/cs-seo 9.2.0.