Home

Description

Movable Type contains a stored cross-site scripting vulnerability in Edit Comment. If crafted input is stored by an attacker, arbitrary script may be executed on a logged-in user's web browser. Note that Movable Type 7 series and 8.4 series, which are End-of-Life (EOL), are affected by the vulnerability as well.

PUBLISHED Reserved 2026-01-29 | Published 2026-02-04 | Updated 2026-02-04 | Assigner jpcert




MEDIUM: 5.4CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

MEDIUM: 4.8CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:A/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N

Problem types

Cross-site scripting (XSS)

Product status

9.0.4 to 9.0.5 (9.0 series)
affected

8.8.0 to 8.8.1 (8.8 series)
affected

8.0.2 to 8.0.8 (8.0 series)
affected

9.0.4 to 9.0.5 (9.0 series)
affected

8.8.0 to 8.8.1 (8.8 series)
affected

8.0.2 to 8.0.8 (8.0 series)
affected

9.0.4 (MTP 9.0 series)
affected

2.13 and earlier (MTP 2 series)
affected

9.0.4 (MTP 9.0 series)
affected

2.13 and earlier (MTP 2 series)
affected

9.0.5 (9 series)
affected

8.8.1 (8 series)
affected

9.0.5 (9 series)
affected

2.12 (MTP 2 series)
affected

References

movabletype.org/news/2026/02/mt-906-released.html

www.sixapart.jp/movabletype/news/2026/02/04-1100.html

jvn.jp/en/jp/JVN45405689/

cve.org (CVE-2026-21393)

nvd.nist.gov (CVE-2026-21393)

Download JSON