Movable Type contains a stored cross‑site scripting flaw in the Export Sites feature. If an attacker supplies crafted data that is stored by the system, the malicious script will run whenever a logged‑in user views the exported content. The known weakness is identified as CWE‑79, which permits attackers to inject client‑side code that compromises confidentiality and integrity of the victim’s browser session.

The affected products are Six Apart’s Movable Type editions: Cloud Edition, Software Edition, Advanced, Premium (Advanced Edition), Premium (Cloud Edition), and Premium (Software Edition). Versions 7.x and 8.4.x, which are end‑of‑life, also are susceptible. Specific version numbers are not listed in the available data.

The CVSS score of 4.8 indicates a moderate severity. Exploitation probability, per EPSS, is less than 1 %, suggesting a low likelihood of widespread attacks. The issue is not present in CISA’s Known Exploited Vulnerabilities catalog. Based on the description, the likely attack vector is through the web interface that handles Export Sites, where an attacker must create or modify content that is later rendered to other users’ browsers. No public exploitation has been reported, and the exploitation conditions require authorized access to the export functionality or the ability to inject content that is subsequently displayed.