CVE-2025-25054: Six Apart Ltd Movable Type 8.0.x Series

Medium severity, CVSS 6.1. EPSS: 0.3% chance of exploitation in the next 30 days.

Movable Type contains a reflected cross-site scripting vulnerability in the user information edit page. When Multi-Factor authentication plugin is enabled and a user accesses a crafted page while logged in to the affected product, an arbitrary script may be executed on the web browser of the user.

Affected products

• Six Apart Ltd Movable Type 8.0.x Series: up to and including 8.0.5
• Six Apart Ltd Movable Type 8.4.x Series: up to and including 8.4.1
• Six Apart Ltd Movable Type Advanced 8.0.x Series: up to and including 8.0.5
• Six Apart Ltd Movable Type Advanced 8.4.x Series: up to and including 8.4.1
• Six Apart Ltd Movable Type Cloud Edition 8.x Series: up to and including 8.4.1
• Six Apart Ltd Movable Type Premium 2.x Series: up to and including 2.06
• Six Apart Ltd Movable Type Premium Advanced Edition 2.x Series: up to and including 2.06
• Six Apart Ltd Movable Type Premium Cloud Edition 2.x Series: up to and including 2.06

Published 2025-02-19. Last modified 2026-06-17.