CVE-2026-22875: Movable Type Stored XSS Vulnerability

CVE-2026-22875 Overview

Movable Type, a content management system developed by Six Apart, contains a stored cross-site scripting (XSS) vulnerability in its Export Sites functionality. If crafted input is stored by an attacker, arbitrary script may be executed on a logged-in user's web browser when they access the affected Export Sites feature. This vulnerability is particularly concerning as it also affects Movable Type 7 series and 8.4 series, which have reached End-of-Life (EOL) status and will not receive security patches.

Critical Impact

Authenticated attackers can inject malicious scripts that execute in the browsers of other logged-in users, potentially leading to session hijacking, credential theft, or unauthorized actions performed on behalf of victims.

Affected Products

• Movable Type (versions prior to 6.9.6)
• Movable Type 7 series (End-of-Life)
• Movable Type 8.4 series (End-of-Life)

Discovery Timeline

• February 4, 2026 - CVE-2026-22875 published to NVD
• February 4, 2026 - Last updated in NVD database

Technical Details for CVE-2026-22875

Vulnerability Analysis

This stored cross-site scripting vulnerability (CWE-79) exists within the Export Sites functionality of Movable Type. Unlike reflected XSS attacks where malicious scripts must be delivered through a crafted URL, stored XSS vulnerabilities persist the malicious payload within the application's data store. When other users subsequently access the affected feature, the malicious script is retrieved from the server and executed in their browser context.

The vulnerability requires an attacker to have some level of authenticated access to the Movable Type platform to inject the malicious payload. Once stored, the script executes whenever a logged-in user interacts with the Export Sites feature, running with the full privileges of the victim's session.

Root Cause

The root cause of this vulnerability is improper input validation and output encoding within the Export Sites functionality. User-supplied data is not adequately sanitized before being stored in the database, and is not properly encoded when rendered in the browser. This allows an attacker to inject JavaScript code that persists and executes in the context of other users' sessions.

Attack Vector

The attack is network-based and requires an authenticated attacker to first inject malicious content into the Export Sites feature. The exploitation chain involves:

1. An attacker with valid credentials accesses the Movable Type administrative interface
2. The attacker crafts and submits malicious JavaScript payload through the Export Sites functionality
3. The payload is stored in the application without proper sanitization
4. When other authenticated users (including administrators) access the Export Sites feature, the malicious script executes in their browser
5. The script can then perform actions such as stealing session cookies, capturing keystrokes, or performing unauthorized operations using the victim's privileges

The stored nature of this XSS vulnerability means the payload persists until manually removed, potentially affecting multiple users over an extended period. Organizations running EOL versions of Movable Type (7 series and 8.4 series) face heightened risk as no patches will be provided for those versions.

Detection Methods for CVE-2026-22875

Indicators of Compromise

• Unexpected JavaScript code or HTML tags present in Export Sites configuration or data fields
• Browser console errors or unexpected script execution when accessing Export Sites functionality
• Unusual session activity or authentication events following user interaction with the Export Sites feature
• Log entries showing suspicious payload patterns in requests to Export Sites endpoints

Detection Strategies

• Review web server access logs for requests containing encoded JavaScript patterns (<script>, javascript:, event handlers like onerror, onload) targeting Export Sites URLs
• Implement Content Security Policy (CSP) headers to detect and report inline script execution attempts
• Configure web application firewalls (WAF) to detect and alert on XSS payload patterns in POST requests to administrative interfaces
• Perform periodic security audits of stored data in Export Sites functionality for suspicious content

Monitoring Recommendations

• Enable verbose logging for the Movable Type administrative interface and Export Sites feature
• Monitor for unusual user session patterns such as concurrent sessions or unexpected geographic locations
• Set up alerting for CSP violation reports that may indicate XSS exploitation attempts
• Track changes to Export Sites configurations and flag unexpected modifications for review

How to Mitigate CVE-2026-22875

Immediate Actions Required

• Upgrade Movable Type to version 6.9.6 or later immediately
• Organizations running EOL versions (7 series or 8.4 series) should prioritize migration to a supported version or alternative CMS platform
• Review existing Export Sites data for potentially malicious content and remove any suspicious entries
• Implement Content Security Policy headers to mitigate the impact of potential XSS exploitation

Patch Information

Six Apart has released Movable Type version 6.9.6 which addresses this stored XSS vulnerability. The security update is available through the official Movable Type website. Organizations should review the Movable Type 6.9.6 Release notes and the Six Apart Movable Type Update for additional details. The JVN #454056 Advisory provides the original security advisory information.

Note that Movable Type 7 series and 8.4 series are End-of-Life and will not receive patches for this vulnerability. Organizations using these versions must migrate to a supported version.

Workarounds

• Implement strict Content Security Policy (CSP) headers to prevent inline script execution, reducing the impact of XSS attacks
• Restrict access to the Export Sites functionality to only trusted administrator accounts
• Consider implementing additional input validation at the web server or WAF level for requests to the Movable Type administrative interface
• Regularly audit and rotate session tokens for administrative accounts to limit the window of opportunity for session hijacking

# Example CSP header configuration for Apache
# Add to .htaccess or virtual host configuration
Header set Content-Security-Policy "default-src 'self'; script-src 'self'; style-src 'self' 'unsafe-inline'; img-src 'self' data:; frame-ancestors 'self';"