CVE-2009-2492: Six Apart Movable Type

Low severity, CVSS 2.6. EPSS: 1.1% chance of exploitation in the next 30 days.

Cross-site scripting (XSS) vulnerability in mt-wizard.cgi in Six Apart Movable Type before 4.261 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors, a different vulnerability than CVE-2009-2480.

Affected products

• Six Apart Movable Type: up to and including 4.25; version 1.54 only; version 2.6 only; version 2.63 only; version 3.3 only; version 3.16 only; …
• Six Apart Ltd Movable Type: any version; version 3.33 only
• Sixapart Movable Type: version 1.00 only; version 1.1 only; version 1.2 only; version 1.3 only; version 1.4 only; version 1.5 only; …

Published 2009-07-17. Last modified 2026-06-16.