Movable Type contains a reflected cross-site scripting vulnerability in the...

6.1 CVSS

Vulnerability Description

Movable Type contains a reflected cross-site scripting vulnerability in the user information edit page. When Multi-Factor authentication plugin is enabled and a user accesses a crafted page while logged in to the affected product, an arbitrary script may be executed on the web browser of the user.

Impact Analysis

Refer to official advisory for detailed impact metrics.

Remediation

Ensure systems are updated to the latest vendor-supplied patch levels.

THREAT MONITOR

Am I Vulnerable?

Launch our assessment wizard to check if your infrastructure is exposed to • CVE-2025-25054

Check My Exposure

Credits & Attribution

No credits recorded in the NVD database.

References

More from Six Apart Ltd.

View All →

CVE-2025-62499

Movable Type contains a stored cross-site scripting vulnerability in Edit...

Medium 4.6

CVE-2025-55706

URL redirection to untrusted site ('Open Redirect') issue exists...

Medium 5.1

CVE-2025-54856

Movable Type contains a stored cross-site scripting vulnerability in Edit...

Medium 4.6

CVE-2025-53522

Movable Type contains an issue with use of less trusted...

Medium 6.9

CVE-2025-24841

Movable Type contains a stored cross-site scripting vulnerability in the...

Medium 5.4

Affected Vendor

Six Apart Ltd.

View all reports →

Affected Software

Movable Type (8.4.x series), Movable Type (8.0.x series), Movable Type Advanced (8.4.x series), Movable Type Advanced (8.0.x series), Movable Type Premium (2.x series), Movable Type Premium (Advanced Edition) (2.x series), Movable Type Cloud Edition (8.x series), Movable Type Premium Cloud Edition (2.x series)

Vulnerable Versions:

8.4.1 and earlier, 8.0.5 and earlier, 2.06 and earlier