Track vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
4.8
CVE-2026-22875: Movable Type Export Sites Allows Malicious Code to Run on User Browsers
CVE-2026-22875 · published 9 months ago
Summary
Movable Type versions 8.7 and earlier contain a security flaw that lets attackers inject malicious code into a logged-in user's web browser. This could allow them to steal sensitive information or take control of the user's account. Users should update to the latest version of Movable Type to fix the issue.
Original advisory text
Movable Type contains a stored cross-site scripting vulnerability in Export Sites. If crafted input is stored by an attacker, arbitrary script may be executed on a logged-in user's web browser. Not...
Movable Type contains a stored cross-site scripting vulnerability in Export Sites. If crafted input is stored by an attacker, arbitrary script may be executed on a logged-in user's web browser. Note that Movable Type 7 series and 8.4 series, which are End-of-Life (EOL), are affected by the vulnerability as well.
Internet-facing
60 days
Internal
At next upgrade
- Not known to be exploited
- Needs hands-on effort to exploit
- Gives an attacker partial control
Type
CWE-79Cross-site Scripting (XSS)
Timeline
Published4 Feb 2026
Updated31 Oct 2026
First seen7 Mar 2026
Sources
CVE-2026-22875 · NVD
Track software like this
Free during beta