CVE-2025-22888
CVE-2025-22888
Vexday Risk Score
13Low
SSVC decision (CISA)
Track
No exploitation signal → monitor
CVSS 5.4EPSS 0.2%KEV nãoPoC —Nuclei —Metasploit —Patch —
Lifecycle
19 Feb 2025Published on NVD
Recommendation: Monitor — no exploitation signal at the moment.
Movable Type contains a stored cross-site scripting vulnerability in the custom block edit page of MT Block Editor. If exploited, an arbitrary script may be executed on a logged-in user's web browser.
CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
Affected products
Six Apart Ltd. · Movable Type (8.0.x series)Six Apart Ltd. · Movable Type (8.4.x series)Six Apart Ltd. · Movable Type Advanced (8.0.x series)Six Apart Ltd. · Movable Type Advanced (8.4.x series)Six Apart Ltd. · Movable Type Cloud Edition (8.x series)Six Apart Ltd. · Movable Type Premium (2.x series)Six Apart Ltd. · Movable Type Premium (Advanced Edition) (2.x series)Six Apart Ltd. · Movable Type Premium Cloud Edition (2.x series)Want to know if your infrastructure is exposed to this?
Talk to TrueHacking →