Movable Type contains a stored cross-site scripting vulnerability in the...

5.4 CVSS

Vulnerability Description

Movable Type contains a stored cross-site scripting vulnerability in the HTML edit mode of MT Block Editor. It is exploitable when TinyMCE6 is used as a rich text editor and an arbitrary script may be executed on a logged-in user's web browser.

Impact Analysis

Refer to official advisory for detailed impact metrics.

Remediation

Ensure systems are updated to the latest vendor-supplied patch levels.

THREAT MONITOR

Am I Vulnerable?

Launch our assessment wizard to check if your infrastructure is exposed to • CVE-2025-24841

Check My Exposure

Credits & Attribution

No credits recorded in the NVD database.

References

More from Six Apart Ltd.

View All →

CVE-2025-62499

Movable Type contains a stored cross-site scripting vulnerability in Edit...

Medium 4.6

CVE-2025-55706

URL redirection to untrusted site ('Open Redirect') issue exists...

Medium 5.1

CVE-2025-54856

Movable Type contains a stored cross-site scripting vulnerability in Edit...

Medium 4.6

CVE-2025-53522

Movable Type contains an issue with use of less trusted...

Medium 6.9

CVE-2025-25054

Movable Type contains a reflected cross-site scripting vulnerability in the...

Medium 6.1

Affected Vendor

Six Apart Ltd.

View all reports →

Affected Software

Movable Type (8.4.x series), Movable Type (8.0.x series), Movable Type Advanced (8.4.x series), Movable Type Advanced (8.0.x series), Movable Type Premium (2.x series), Movable Type Premium (Advanced Edition) (2.x series), Movable Type Cloud Edition (8.x series), Movable Type Premium Cloud Edition (2.x series)

Vulnerable Versions:

8.4.1 and earlier, 8.0.5 and earlier, 2.06 and earlier