CVE-2026-21393: Six Apart Ltd Movable Type Advanced Software Edition

Medium severity, CVSS 4.8. EPSS: 0.2% chance of exploitation in the next 30 days.

Movable Type contains a stored cross-site scripting vulnerability in Edit Comment. If crafted input is stored by an attacker, arbitrary script may be executed on a logged-in user's web browser. Note that Movable Type 7 series and 8.4 series, which are End-of-Life (EOL), are affected by the vulnerability as well.

Affected products

• Six Apart Ltd Movable Type Advanced Software Edition
• Six Apart Ltd Movable Type Cloud Edition: version 9.0.5 (9 series) only; version 8.8.1 (8 series) only
• Six Apart Ltd Movable Type Premium Advanced Edition Software Edition
• Six Apart Ltd Movable Type Premium Cloud Edition: version 9.0.5 (9 series) only
• Six Apart Ltd Movable Type Premium Software Edition
• Six Apart Ltd Movable Type Software Edition

Published 2026-02-04. Last modified 2026-06-17.