CVE-2025-24841: Movable Type Stored XSS Vulnerability

CVE-2025-24841 Overview

CVE-2025-24841 is a stored cross-site scripting (XSS) vulnerability in Movable Type, a widely used content management and blogging platform. The flaw resides in the HTML edit mode of the MT Block Editor and is exploitable when TinyMCE6 is configured as the rich text editor. An authenticated attacker with content authoring privileges can inject malicious script content that executes in the browser of any logged-in user who views the affected content. The vulnerability is tracked under [CWE-79] (Improper Neutralization of Input During Web Page Generation).

Critical Impact

Stored XSS enables session hijacking, credential theft, and unauthorized actions performed in the context of authenticated Movable Type users, including administrators.

Affected Products

• Movable Type (versions prior to MT 8.4.2 / corresponding fixed releases)
• Movable Type instances using the MT Block Editor with HTML edit mode enabled
• Movable Type deployments configured with TinyMCE6 as the rich text editor

Discovery Timeline

• 2025-02-19 - CVE-2025-24841 published to the National Vulnerability Database
• 2026-04-15 - Last updated in NVD database

Technical Details for CVE-2025-24841

Vulnerability Analysis

The vulnerability arises in the HTML edit mode of the MT Block Editor when TinyMCE6 handles rich text input. The editor accepts HTML markup directly from authenticated authors but fails to neutralize script-bearing constructs before storing and later rendering the content. When another logged-in user views the affected post, page, or editor preview, the injected payload executes in their browser session.

Because the payload is stored server-side, the attack persists across sessions and reaches any user who loads the affected resource. The CVSS vector indicates the scope changes upon successful exploitation, meaning the impact crosses from the authoring component into the viewing user's browser context. User interaction is required, typically loading the malicious post in an authenticated session.

Root Cause

The root cause is improper neutralization of HTML and JavaScript content submitted through the TinyMCE6-backed HTML edit mode. The MT Block Editor trusts the rich text input from authenticated authors and does not strip or encode script-capable elements such as <script> tags, event handler attributes, or javascript: URIs before persisting them.

Attack Vector

An attacker requires low-privilege authenticated access, such as a content author or contributor role. The attacker creates or edits content using the HTML edit mode of the MT Block Editor and embeds a malicious payload. When an administrator or another logged-in user opens the content, the script executes with that victim's privileges, enabling session token theft, CSRF-style actions, account takeover, or pivoting to administrative functions.

No verified public proof-of-concept exists for this issue. Refer to the JVN Security Advisory JVN48742353 and the Movable Type Release Announcement MT-8.4.2 for vendor-provided technical context.

Detection Methods for CVE-2025-24841

Indicators of Compromise

• Stored content in Movable Type entries, pages, or template modules containing <script> tags, inline event handlers such as onerror, onload, onclick, or javascript: URIs introduced through the Block Editor
• Unexpected outbound requests from administrator browsers to attacker-controlled domains shortly after viewing Movable Type content
• Anomalous session token usage or administrative actions performed from unusual IP addresses after content review activity

Detection Strategies

• Audit the Movable Type database for entries created or modified through MT Block Editor HTML mode and search for HTML elements or attributes capable of executing JavaScript
• Review web server access logs for requests to Movable Type editor endpoints originating from low-privilege accounts followed by administrator views of the same content
• Inspect browser security telemetry and Content Security Policy violation reports generated when administrators load editor previews or published entries

Monitoring Recommendations

• Monitor Movable Type authoring activity, especially edits performed by lower-privilege roles, and alert on insertions of <script>, <iframe>, or event-handler attributes
• Track administrator session anomalies including new sessions, password changes, and privilege modifications that follow content viewing events
• Enable and review Content Security Policy reporting to surface unexpected script sources executing in the Movable Type admin interface

How to Mitigate CVE-2025-24841

Immediate Actions Required

• Upgrade Movable Type to the fixed release identified in the Movable Type MT-8.4.2 announcement and apply equivalent patches for supported branches
• Review all content created or edited through the MT Block Editor HTML mode since the editor was deployed and remove any unauthorized script content
• Audit user accounts with authoring privileges and reset credentials for any accounts that may have been used to plant payloads

Patch Information

Movable Type addressed the issue in the release announced as MT-8.4.2. Administrators should consult the vendor advisory at JVN48742353 for the complete list of fixed versions across Movable Type product branches and apply the corresponding update.

Workarounds

• Restrict use of the MT Block Editor HTML edit mode to fully trusted administrative users until the patch is applied
• Disable TinyMCE6 as the active rich text editor where feasible, reverting to a configuration not affected by the issue
• Enforce a strict Content Security Policy on the Movable Type admin interface to block inline scripts and untrusted script sources, reducing the impact of any stored payloads

# Example restrictive Content Security Policy header for the Movable Type admin interface
Header set Content-Security-Policy "default-src 'self'; script-src 'self'; object-src 'none'; base-uri 'self'; frame-ancestors 'self'"