Movable Type Premium Cloud Edition vulnerabilities

Product

Movable Type Premium Cloud Edition

by Six Apart Ltd. · last CVE Oct 7, 2026

CVEs

On KEV

9.4

Max CVSS

New 30D

Vulnerabilities10 In the news0 Timeline

Severity mix

Critical 1High 1Medium 8Low 0

Severity

All severities10 Critical1 High1 Medium8 Low0

Exploitation

On CISA KEV0 Exploited in the wild0

Watch

Add Movable Type Premium Cloud Edition to your stack to get only the CVEs that touch what you run.

CVE	CVSS	EPSS	Published	Summary · affected versions
CVE-2026-96408	9.4	0%	Oct 7	A code injection vulnerability exists in the upgrade script of Movable Type, which may allow an unauthenticated attacker to execute an arbitrary Perl script or an SQL query on the… Affected: 9.2.0 through 9.2.1
CVE-2026-103668	8.6	0%	Oct 7	An SQL Injection vulnerability exists in the Site Search function of Movable Type, which may allow an unauthenticated attacker to execute an arbitrary SQL query on the affected… Affected: 9.2.0 through 9.2.1
CVE-2026-24447	6.5	0%	Feb 4	If a malformed data is input to the affected product, a CSV file downloaded from the affected product may contain such malformed data Affected: 9.0.5 (9 series); 2.12 (MTP 2 series)
CVE-2026-23704	6.5	0%	Feb 4	A non-administrative user can upload malicious files Affected: 9.0.5 (9 series); 2.12 (MTP 2 series)
CVE-2026-22875	5.4	0%	Feb 4	Movable Type contains a stored cross-site scripting vulnerability in Export Sites Affected: 9.0.5 (9 series); 2.12 (MTP 2 series)
CVE-2026-21393	5.4	0%	Feb 4	Movable Type contains a stored cross-site scripting vulnerability in Edit Comment Affected: 9.0.5 (9 series); 2.12 (MTP 2 series)
CVE-2025-53522	5.3	0%	Aug 20	Movable Type contains an issue with use of less trusted source Affected: 2.09 (2 series); 1.66 (1 series)
CVE-2025-62499	4.8	0%	Oct 23	Movable Type contains a stored cross-site scripting vulnerability in Edit CategorySet of ContentType page Affected: 2.10 (2 series); 1.67 (1 series)
CVE-2025-54856	4.8	0%	Oct 23	Movable Type contains a stored cross-site scripting vulnerability in Edit ContentData page Affected: 2.10 (2 series); 1.67 (1 series)
CVE-2025-55706	4.3	0%	Aug 20	URL redirection to untrusted site ('Open Redirect') issue exists in Movable Type Affected: 2.09 (2 series); 1.66 (1 series)