CVE-2025-24841

Movable Type contains a stored cross-site scripting vulnerability in the HTML edit mode of MT Block Editor. It is exploitable when TinyMCE6 is used as a rich text editor and an arbitrary script may be executed on a logged-in user's web browser.

Score

CVSS 3.0 5.4 Medium

Status

Deferred - vultures@jpcert.or.jp

Published

2025-02-19

Last modified

2025-02-19

Weaknesses

CWE-79

Affected products

• Movable Type 8.0.x Series (Six Apart Ltd.)
• Movable Type 8.4.x Series (Six Apart Ltd.)
• Movable Type Advanced 8.0.x Series (Six Apart Ltd.)
• Movable Type Advanced 8.4.x Series (Six Apart Ltd.)
• Movable Type Cloud Edition 8.x Series (Six Apart Ltd.)
• Movable Type Premium 2.x Series (Six Apart Ltd.)
• Movable Type Premium Advanced Edition 2.x Series (Six Apart Ltd.)
• Movable Type Premium Cloud Edition 2.x Series (Six Apart Ltd.)

References

• https://jvn.jp/en/jp/JVN48742353/
• https://www.movabletype.org/news/2025/02/mt-842-released.html