VulnerabilityDeferred

CVE-2025-62499

Movable Type contains a stored cross-site scripting vulnerability in Edit CategorySet of ContentType page.

MEDIUM 4.6EPSS 0.21%

Does this matter?

Lower severity and a low EPSS score (0.21%). Track it; it rarely justifies an emergency change on its own.

Description

Movable Type contains a stored cross-site scripting vulnerability in Edit CategorySet of ContentType page. If crafted input is stored by an attacker with "ContentType Management" privilege, an arbitrary script may be executed on the web browser of the user who accesses Edit CategorySet of ContentType page.

CVSS 4.0: 4.6 MEDIUMCVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:A/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/M
EPSS: 0.21% probability · 12th percentile
CISA KEV: Not listed
Weakness: CWE-79
Source: vultures@jpcert.or.jp

References

https://jvn.jp/en/jp/JVN24333679/
https://movabletype.org/news/2025/10/mt-880-released.html
https://www.sixapart.jp/movabletype/news/2025/10/22-1055.html

Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.