Stored Cross-Site Scripting in Movable Type by Six Apart
CVE-2025-22888

5.4MEDIUM

Key Information:

Vendor

Six Apart Ltd.

Status
Movable Type (8.4.x Series)
Movable Type (8.0.x Series)
Movable Type Advanced (8.4.x Series)
Movable Type Advanced (8.0.x Series)
Vendor
CVE Published:
19 February 2025

What is CVE-2025-22888?

Movable Type contains a vulnerability in its custom block edit page within the MT Block Editor, allowing attackers to inject malicious scripts. If a user is logged in, the executed script can compromise their session, potentially leading to unauthorized actions or data exposure. Users of Movable Type should take precautions to mitigate this risk and apply security updates promptly.

Affected Version(s)

Movable Type (8.0.x series) 8.0.5 and earlier

Movable Type (8.4.x series) 8.4.1 and earlier

Movable Type Advanced (8.0.x series) 8.0.5 and earlier

References

https://www.movabletype.org/news/2025/02/mt-842-released....
https://jvn.jp/en/jp/JVN48742353/

CVSS V3.0

Score:
5.4
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
Low
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
Low
User Interaction:
Required
Scope:
Changed

Timeline

  • Vulnerability published

  • Vulnerability Reserved

JSON
.