Volerion logoVolerion
Volerion logoVolerion

Movable Type Reflected Cross-Site Scripting Vulnerability in User Information Edit Page

Vulnerability

A reflected cross-site scripting vulnerability has been identified in Movable Type, affecting versions through 8.4.1 in the 8.4.x series, versions through 8.0.5 in the 8.0.x series, and several versions in the 2.x series. This vulnerability occurs on the user information edit page when the Multi-Factor Authentication plugin is enabled. A logged-in user who accesses a crafted page may have arbitrary scripts executed in their web browser.

Impact

Exploitation of this vulnerability allows for the execution of arbitrary scripts in the web browser of a logged-in user.

Remediation

Users can upgrade to Movable Type 8.4.2, 8.0.6, or Movable Type Premium 2.07. For Movable Type Cloud Edition, version 8.5.0 is available. Instructions for downloading the latest version can be found on the Movable Type website.

Added: Jun 9, 2025, 7:46 PM
Updated: Jun 9, 2025, 7:46 PM

Vulnerability Rating

Custom Algorithm
spread
5.2
impact
5.4
exploitability
6.5
remediation
7.7
relevance
0.0
threat
0.0
urgency
2.9
incentive
1.7

Our algorithm analyzes dozens of metrics to generate these 8 key vulnerability categories, which are then combined to calculate the overall risk score.