Movable Type Advanced (Software Edition) vulnerabilities

Product

Movable Type Advanced (Software Edition)

by Six Apart Ltd. · last CVE Feb 4, 2026

CVEs

On KEV

6.5

Max CVSS

New 30D

Vulnerabilities8 In the news0 Timeline

Severity mix

Critical 0High 0Medium 8Low 0

Severity

All severities8 Critical0 High0 Medium8 Low0

Exploitation

On CISA KEV0 Exploited in the wild0

Watch

Add Movable Type Advanced (Software Edition) to your stack to get only the CVEs that touch what you run.

CVE	CVSS	EPSS	Published	Summary · affected versions
CVE-2026-24447	6.5	0%	Feb 4	If a malformed data is input to the affected product, a CSV file downloaded from the affected product may contain such malformed data Affected: 9.0.4 to 9.0.5 (9.0 series); 8.8.0 to 8.8.1 (8.8 series); 8.0.2 to 8.0.8 (8.0 series)
CVE-2026-23704	6.5	0%	Feb 4	A non-administrative user can upload malicious files Affected: 9.0.4 to 9.0.5 (9.0 series); 8.8.0 to 8.8.1 (8.8 series); 8.0.2 to 8.0.8 (8.0 series)
CVE-2026-22875	5.4	0%	Feb 4	Movable Type contains a stored cross-site scripting vulnerability in Export Sites Affected: 9.0.4 to 9.0.5 (9.0 series); 8.8.0 to 8.8.1 (8.8 series); 8.0.2 to 8.0.8 (8.0 series)
CVE-2026-21393	5.4	0%	Feb 4	Movable Type contains a stored cross-site scripting vulnerability in Edit Comment Affected: 9.0.4 to 9.0.5 (9.0 series); 8.8.0 to 8.8.1 (8.8 series); 8.0.2 to 8.0.8 (8.0 series)
CVE-2025-53522	5.3	0%	Aug 20	Movable Type contains an issue with use of less trusted source Affected: 8.0.0 to 8.0.6; 8.4.0 to 8.4.2 (8 series); 7 r.5508 and earlier (7 series)
CVE-2025-62499	4.8	0%	Oct 23	Movable Type contains a stored cross-site scripting vulnerability in Edit CategorySet of ContentType page Affected: 8.4.0 to 8.4.3 (8.4 series); 8.0.0 to 8.0.7 (8.0 series); 7 r.5509 and earlier (7 series)
CVE-2025-54856	4.8	0%	Oct 23	Movable Type contains a stored cross-site scripting vulnerability in Edit ContentData page Affected: 8.4.0 to 8.4.3 (8.4 series); 8.0.0 to 8.0.7 (8.0 series); 7 r.5509 and earlier (7 series)
CVE-2025-55706	4.3	0%	Aug 20	URL redirection to untrusted site ('Open Redirect') issue exists in Movable Type Affected: 8.0.0 to 8.0.6; 8.4.0 to 8.4.2 (8 series); 7 r.5508 and earlier (7 series)