CVE-2025-54856CWE-79

Movable Type contains a stored cross-site scripting vulnerability in Edit ContentData page

Medium · published October 23, 2025

CVSS v4.0
4.6
EPSS
0%
Percentile
13.5
In the wild
Unconfirmed
What it is

Movable Type contains a stored cross-site scripting vulnerability in Edit ContentData page. If crafted input is stored by an attacker with "ContentType Management" privilege, an arbitrary script may be executed on the web browser of the user who accesses Edit ContentData page.

The record
Technical detail
CVSS v4.0
4.6 · MEDIUM
Vector
CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:A/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N
EPSS
0.00234 · 13.5th percentile
Weakness
CWE-79 · Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Published
2025-10-23T04:10Z
EPSS history
Timeline
  • 23 OCT 04:10Z
    Movable Type contains a stored cross-site scripting vulnerability in Edit ContentData page
    cvelistv5