Movable Type Stored Cross-Site Scripting Vulnerability in Comment Editing

A stored cross-site scripting vulnerability has been identified in Movable Type, affecting versions 9.0.4 to 9.0.5, 8.8.0 to 8.8.1, 8.0.2 to 8.0.8, and 2.13 and earlier of Movable Type Premium. Additionally, Movable Type 7 series and 8.4 series, which are End-of-Life, are also affected. This vulnerability allows an attacker to inject crafted input that is stored and later executed as arbitrary script in the web browser of a logged-in user.

Impact

Exploitation of this vulnerability allows for stored cross-site scripting, where injected scripts are executed in the context of the user's browser.

Remediation

Users can update to Movable Type versions 9.0.6, 8.8.2, or 8.0.9. Movable Type Premium users should update to version 9.1.0 or 2.14. For those using Movable Type Cloud Edition, version 9.1.0 or 8.8.2 is available. Instructions for updating are available on the Movable Type documentation site.