CVE-2025-24841

Severity: medium (CVSS 5.4 v3.0)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.2% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2025-02-19 · updated 2026-06-17
Weakness: CWE-79

Description

Movable Type contains a stored cross-site scripting vulnerability in the HTML edit mode of MT Block Editor. It is exploitable when TinyMCE6 is used as a rich text editor and an arbitrary script may be executed on a logged-in user's web browser.

Affected products

Six Apart Ltd. Movable Type (8.0.x series): through 8.0.5
Six Apart Ltd. Movable Type (8.4.x series): through 8.4.1
Six Apart Ltd. Movable Type Advanced (8.0.x series): through 8.0.5
Six Apart Ltd. Movable Type Advanced (8.4.x series): through 8.4.1
Six Apart Ltd. Movable Type Cloud Edition (8.x series): through 8.4.1
Six Apart Ltd. Movable Type Premium (2.x series): through 2.06
Six Apart Ltd. Movable Type Premium (Advanced Edition) (2.x series): through 2.06
Six Apart Ltd. Movable Type Premium Cloud Edition (2.x series): through 2.06

References

Get alerted when CVE-2025-24841 or the next vulnerability affects your stack