Unscored severity · published Jan 30, 2007
CVE-2007-0604
Cross-site scripting (XSS) vulnerability in Movable Type (MT) before 3.34 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors related to the…
–
CVSS
1.1%
EPSS
No
On KEV
Description
Cross-site scripting (XSS) vulnerability in Movable Type (MT) before 3.34 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors related to the MTCommentPreviewIsStatic tag, which can open the "comment entry screen," a different vulnerability than CVE-2007-0231.
Exploitation
Is it being used?
Exploit prediction (EPSS)1.1% · higher than 65% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
MT
Movable Type · Six Apart Ltd
through 3.33 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2007-0604
CVE.org
https://www.cve.org/CVERecord?id=CVE-2007-0604
osvdb.org
http://osvdb.org/32987
www.sixapart.com
http://www.sixapart.com/movabletype/beta/distros/MT-3.34-beta-Release-Notes.html
More from Movable Type
9.8
CVE-2026-25776
Movable Type provided by Six Apart Ltd
9.8
CVE-2026-33088
Movable Type provided by Six Apart Ltd
9.4
CVE-2026-96408
A code injection vulnerability exists in the upgrade script of Movable Type, which may allow an unauthenticated attacker to execute an arbitrary Perl script or an SQL query on the…
8.6
CVE-2026-103668
An SQL Injection vulnerability exists in the Site Search function of Movable Type, which may allow an unauthenticated attacker to execute an arbitrary SQL query on the affected…
4.3
CVE-2026-44392
Missing authorization vulnerability exists in Movable Type