Stored Cross-Site Scripting in Movable Type by Six Apart
CVE-2025-22888
5.4MEDIUM
Summary
Movable Type contains a vulnerability in its custom block edit page within the MT Block Editor, allowing attackers to inject malicious scripts. If a user is logged in, the executed script can compromise their session, potentially leading to unauthorized actions or data exposure. Users of Movable Type should take precautions to mitigate this risk and apply security updates promptly.
Affected Version(s)
Movable Type (8.0.x series) 8.0.5 and earlier
Movable Type (8.4.x series) 8.4.1 and earlier
Movable Type Advanced (8.0.x series) 8.0.5 and earlier
References
CVSS V3.0
Score:
5.4
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
Low
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
Low
User Interaction:
Required
Scope:
Changed
Timeline
Vulnerability published
Vulnerability Reserved