CVE-2025-25054: XSS

Published Feb 19, 2025

Updated

Movable Type contains a reflected cross-site scripting vulnerability in the user information edit page. When Multi-Factor authentication plugin is enabled and a user accesses a crafted page while logged in to the affected product, an arbitrary script may be executed on the web browser of the user.

Affected Software

1 affected component

Movable Type Movable Type

Event History

Feb 19, 2025

CVE Published

via NVD·06:15 AM

Data Sourced

via NVD·06:15 AM

DescriptionSeverityWeakness

Frequently Asked Questions

What is the severity of CVE-2025-25054?

CVE-2025-25054 is classified as a reflected cross-site scripting (XSS) vulnerability.

How do I fix CVE-2025-25054?

To fix CVE-2025-25054, update Movable Type to the latest version where the vulnerability is patched.

What products are affected by CVE-2025-25054?

CVE-2025-25054 affects the Movable Type software, particularly when the Multi-Factor authentication plugin is enabled.

Who can exploit CVE-2025-25054?

Any logged-in user can exploit CVE-2025-25054 by accessing a specially crafted page.

What are the potential impacts of CVE-2025-25054?

The potential impact of CVE-2025-25054 includes arbitrary script execution in the user's web browser.