Movable Type implements a stored cross‑site scripting flaw in the Edit Comment feature. When an attacker supplies crafted input that gets saved, every user who later views the comment while logged in will have that script run in their browser. The vulnerability directly compromises the integrity of the user experience and can be leveraged for malicious activities such as session hijacking or data exfiltration within the scope of the trusted user session.

All Six Apart Movable Type deployments, including the Cloud Edition, Software Edition, Advanced Edition, and Premium Edition. The flaw is confirmed in the 7 series and 8.4 series releases, which are already End‑of‐Life. Any other current releases are likely affected until a patch is applied, because the underlying edit-comment processing has not been altered.

The CVSS score of 4.8 reflects a medium severity vulnerability, while the EPSS figure of below 1 % indicates a low likelihood of exploitation at present. The issue is not yet cataloged by CISA’s KEV list. Attackers could exploit the flaw by posting a malicious comment or by injecting script into an existing comment—any logged‑in user who views the comment will have the code executed. No remote code execution beyond the browser context is necessary, but the impact is significant for users with privileged accounts.