Movable Type Stored XSS Vulnerabilities (CVE-2025-54856/CVE-2025-62499) Advisory

Key Information Vulnerability Overview Vulnerability ID: JVN#24333679 Vulnerability Type: Multiple stored cross-site scripting vulnerabilities Affected Product: Movable Type by Six Apart Ltd. Affected Product Versions Movable Type Software Edition - Movable Type / Movable Type Advanced: - 8.4.0 to 8.4.3 (8.4 series) - 8.0.0 to 8.0.7 (8.0 series) - 7.x ≤ 5509 and earlier (7 series) - Movable Type Premium / Movable Type Premium (Advanced Edition): - 2.1.0 and earlier (2 series) - 1.6.0 and earlier (1 series) Movable Type Cloud Edition - Movable Type: - 8.7.0 (8 series) - 7.x ≤ 5509 (7 series) - Movable Type Premium: - 2.1.0 (2 series) - 1.6.7 (1 series) Vulnerability Description Stored Cross-Site Scripting in Edit ContentData Page (CWE-79) - CVSS v3.0 AV:N/AC:L/AT:N/PR:H/UI:A/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N Base Score 4.6 - CVSS v3.0 AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N Base Score 4.8 - CVE-2025-54856 Stored Cross-Site Scripting in Edit CategorySet of ContentType Page (CWE-79) - CVSS v3.0 AV:N/AC:L/AT:N/PR:H/UI:A/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N Base Score 4.6 - CVSS v3.0 AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N Base Score 4.0 - CVE-2025-62499 Impact If an attacker exploits user input with "ContentType Management" privileges, the following impacts may occur: - Execution of arbitrary scripts in the web browsers of users accessing the Edit ContentData page (CVE-2025-54856) - Execution of arbitrary scripts in the web browsers of users accessing the Edit CategorySet page (CVE-2025-62499) Solution Update Software: Apply appropriate updates as provided by the developer. Updated Versions Movable Type Software Edition - Movable Type / Movable Type Advanced: - 8.0.8 (8.0 series) - 8.4.4 (8.4 series) - 7.x ≥ 5510 (7 series) - Movable Type Premium / Movable Type Premium (Advanced Edition): - 2.1.1 (2 series) - 1.6.0 (1 series) Movable Type Cloud Edition - Movable Type: - 8.8.0 (8 series) - 7.x ≥ 5510 (7 series) - Movable Type Premium: - 2.1.1 (2 series) - 1.6.0 (1 series) Vendor Status Vendor: Six Apart Ltd. Status: Vulnerable Last Updated: 2025/10/22 Vendor Note: Six Apart Ltd. website References JPCERT/CC Addendum Vulnerability Analysis by JPCERT/CC Additional Information CVE: CVE-2025-54856, CVE-2025-62499 JVN iFeed: JVNDB-2025-000090

Goal Reached Thanks to every supporter — we hit 100%!

Movable Type Stored XSS Vulnerabilities (CVE-2025-54856/CVE-2025-62499) Advisory