Six Apart Ltd Movable Type Premium (2.x series)

• CVE-2025-24841 Medium 5.4 Movable Type contains a stored cross-site scripting vulnerability in the HTML edit mode of MT Block Editor. It is exploitable when TinyMCE6 is used as a rich text editor and an arbitrary script may be 0.2%
• CVE-2025-25054 Medium 6.1 Movable Type contains a reflected cross-site scripting vulnerability in the user information edit page. When Multi-Factor authentication plugin is enabled and a user accesses a crafted page while logg 0.3%
• CVE-2025-22888 Medium 5.4 Movable Type contains a stored cross-site scripting vulnerability in the custom block edit page of MT Block Editor. If exploited, an arbitrary script may be executed on a logged-in user's web browser. 0.2%