CVE-2025-24841CWE-79

Movable Type contains a stored cross-site scripting vulnerability in the HTML edit mode of MT Block Editor

Medium · published February 19, 2025

CVSS v3.0
5.4
EPSS
0%
Percentile
12.4
In the wild
Unconfirmed
What it is

Movable Type contains a stored cross-site scripting vulnerability in the HTML edit mode of MT Block Editor. It is exploitable when TinyMCE6 is used as a rich text editor and an arbitrary script may be executed on a logged-in user's web browser.

The record
Technical detail
CVSS v3.0
5.4 · MEDIUM
Vector
CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
CVSS v4.0
Not supplied
EPSS
0.00225 · 12.4th percentile
Weakness
CWE-79 · Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Published
2025-02-19T05:52Z
EPSS history
Timeline
  • 19 FEB 05:52Z
    Movable Type contains a stored cross-site scripting vulnerability in the HTML edit mode of MT Block Editor
    cvelistv5