CVE-2025-25054

Severity: medium (CVSS 6.1 v3.0)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.3% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2025-02-19 · updated 2026-06-17
Weakness: CWE-79

Description

Movable Type contains a reflected cross-site scripting vulnerability in the user information edit page. When Multi-Factor authentication plugin is enabled and a user accesses a crafted page while logged in to the affected product, an arbitrary script may be executed on the web browser of the user.

Affected products

Six Apart Ltd. Movable Type (8.0.x series): through 8.0.5
Six Apart Ltd. Movable Type (8.4.x series): through 8.4.1
Six Apart Ltd. Movable Type Advanced (8.0.x series): through 8.0.5
Six Apart Ltd. Movable Type Advanced (8.4.x series): through 8.4.1
Six Apart Ltd. Movable Type Cloud Edition (8.x series): through 8.4.1
Six Apart Ltd. Movable Type Premium (2.x series): through 2.06
Six Apart Ltd. Movable Type Premium (Advanced Edition) (2.x series): through 2.06
Six Apart Ltd. Movable Type Premium Cloud Edition (2.x series): through 2.06

References

Get alerted when CVE-2025-25054 or the next vulnerability affects your stack