VulnerabilityDeferred

CVE-2025-54856

Movable Type contains a stored cross-site scripting vulnerability in Edit ContentData page.

MEDIUM 4.6EPSS 0.21%

Does this matter?

Lower severity and a low EPSS score (0.21%). Track it; it rarely justifies an emergency change on its own.

Description

Movable Type contains a stored cross-site scripting vulnerability in Edit ContentData page. If crafted input is stored by an attacker with "ContentType Management" privilege, an arbitrary script may be executed on the web browser of the user who accesses Edit ContentData page.

CVSS 4.0: 4.6 MEDIUMCVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:A/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/M
EPSS: 0.21% probability · 12th percentile
CISA KEV: Not listed
Weakness: CWE-79
Source: vultures@jpcert.or.jp

References

https://jvn.jp/en/jp/JVN24333679/
https://movabletype.org/news/2025/10/mt-880-released.html
https://www.sixapart.jp/movabletype/news/2025/10/22-1055.html

Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.