Description
Movable Type contains a stored cross-site scripting vulnerability in the HTML edit mode of MT Block Editor. It is exploitable when TinyMCE6 is used as a rich text editor and an arbitrary script may be executed on a logged-in user's web browser.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| Six Apart | Movable Type (8.4.x series) | 8.4.1 and earlier | — |
| Six Apart | Movable Type (8.0.x series) | 8.0.5 and earlier | — |
| Six Apart | Movable Type Advanced (8.4.x series) | 8.4.1 and earlier | — |
| Six Apart | Movable Type Advanced (8.0.x series) | 8.0.5 and earlier | — |
| Six Apart | Movable Type Premium (2.x series) | 2.06 and earlier | — |
| Six Apart | Movable Type Premium (Advanced Edition) (2.x series) | 2.06 and earlier | — |
| Six Apart | Movable Type Cloud Edition (8.x series) | 8.4.1 and earlier | — |
| Six Apart | Movable Type Premium Cloud Edition (2.x series) | 2.06 and earlier | — |