CVE-2021-20663: Movabletype Movable Type

Medium severity, CVSS 6.1. EPSS: 0.8% chance of exploitation in the next 30 days.

Cross-site scripting vulnerability in in Role authority setting screen of Movable Type 7 r.4705 and earlier (Movable Type 7 Series), Movable Type Advanced 7 r.4705 and earlier (Movable Type Advanced 7 Series), Movable Type 6.7.5 and earlier (Movable Type 6.7 Series), Movable Type Premium 1.39 and earlier, and Movable Type Premium Advanced 1.39 and earlier allows remote attackers to inject an arbitrary script via unspecified vectors.

Affected products

• Movabletype Movable Type: up to and including 6.7.5; from 7.0000, up to and including 7.4705
• Movabletype Movable Type Advanced: up to and including 7.4705
• Movabletype Movable Type Premium: up to and including 1.39
• Movabletype Movable Type Premium Advanced: up to and including 1.39

Published 2021-03-05. Last modified 2026-06-17.