CVE-2009-2480: Movabletype Six Apart Movable Type

Medium severity, CVSS 4.3. EPSS: 1.3% chance of exploitation in the next 30 days.

Cross-site scripting (XSS) vulnerability in mt-wizard.cgi in Six Apart Movable Type 4.24, and 4.25 when global templates are not initialized, allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.

Affected products

• Movabletype Six Apart Movable Type: version 4.24 only; version 4.25 only

Published 2009-07-16. Last modified 2026-06-16.