Back to Database
Status published
Medium
CVE-2025-54856
Movable Type contains a stored cross-site scripting vulnerability in Edit...
Vulnerability Description
Movable Type contains a stored cross-site scripting vulnerability in Edit ContentData page. If crafted input is stored by an attacker with "ContentType Management" privilege, an arbitrary script may be executed on the web browser of the user who accesses Edit ContentData page.
Impact Analysis
Refer to official advisory for detailed impact metrics.
Remediation
Ensure systems are updated to the latest vendor-supplied patch levels.
THREAT MONITOR
Am I Vulnerable?
Launch our assessment wizard to check if your infrastructure is exposed to • CVE-2025-54856
Credits & Attribution
No credits recorded in the NVD database.
References
More from Six Apart Ltd.
View All →CVE-2025-62499
Movable Type contains a stored cross-site scripting vulnerability in Edit...
Medium
4.6
CVE-2025-55706
URL redirection to untrusted site ('Open Redirect') issue exists...
Medium
5.1
CVE-2025-53522
Movable Type contains an issue with use of less trusted...
Medium
6.9
CVE-2025-25054
Movable Type contains a reflected cross-site scripting vulnerability in the...
Medium
6.1
CVE-2025-24841
Movable Type contains a stored cross-site scripting vulnerability in the...
Medium
5.4
Affected Vendor
Six Apart Ltd.
View all reports →Affected Software
Movable Type (Software Edition), Movable Type Advanced (Software Edition), Movable Type Premium (Software Edition), Movable Type Premium (Advanced Edition) (Software Edition), Movable Type (Cloud Edition), Movable Type Premium (Cloud Edition)
Vulnerable Versions:
8.4.0 to 8.4.3 (8.4 series), 8.0.0 to 8.0.7 (8.0 series), 7 r.5509 and earlier (7 series), 2.10 and earlier (2 series), 1.67 and earlier (1 series), 8.7.0 (8 series), 7 r.5509 (7 series), 2.10 (2 series), 1.67 (1 series)
Timeline
Official Publish:
October 23rd, 2025
Last Modified:
October 23rd, 2025
Added to House:
July 22nd, 2026
CVSS Vectors
V3:
CVSS:3.0/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N