CVE-2025-54856

Movable Type contains a stored cross-site scripting vulnerability in Edit ContentData page. If crafted input is stored by an attacker with "ContentType Management" privilege, an arbitrary script may be executed on the web browser of the user who accesses Edit ContentData page...

CVE-2025-62499

Movable Type contains a stored cross-site scripting vulnerability in Edit CategorySet of ContentType page. If crafted input is stored by an attacker with "ContentType Management" privilege, an arbitrary script may be executed on the web browser of the user who accesses Edit CategorySet of...

EUVD-2025-35655

Movable Type contains a stored cross-site scripting vulnerability in Edit CategorySet of ContentType page. If crafted input is stored by an attacker with "ContentType Management" privilege, an arbitrary script may be executed on the web browser of the user who accesses Edit CategorySet of...

CVE-2025-62499

Movable Type contains a stored cross-site scripting vulnerability in Edit CategorySet of ContentType page. If crafted input is stored by an attacker with "ContentType Management" privilege, an arbitrary script may be executed on the web browser of the user who accesses Edit CategorySet of...

CVE-2025-62499

Movable Type contains a stored cross-site scripting vulnerability in Edit CategorySet of ContentType page. If crafted input is stored by an attacker with "ContentType Management" privilege, an arbitrary script may be executed on the web browser of the user who accesses Edit CategorySet of...

CVE-2025-62499

Movable Type contains a stored cross-site scripting vulnerability in the Edit CategorySet of the ContentType page. If an attacker with ContentType Management stores crafted input, an arbitrary script can execute in the browser of users who access that page. Affected product: Movable Type (Six Apa...

EUVD-2025-35656

Movable Type contains a stored cross-site scripting vulnerability in Edit ContentData page. If crafted input is stored by an attacker with "ContentType Management" privilege, an arbitrary script may be executed on the web browser of the user who accesses Edit ContentData page...

CVE-2025-54856

Movable Type contains a stored cross-site scripting vulnerability in Edit ContentData page. If crafted input is stored by an attacker with "ContentType Management" privilege, an arbitrary script may be executed on the web browser of the user who accesses Edit ContentData page...

CVE-2025-54856

Movable Type contains a stored cross-site scripting vulnerability in Edit ContentData page. If crafted input is stored by an attacker with "ContentType Management" privilege, an arbitrary script may be executed on the web browser of the user who accesses Edit ContentData page...

CVE-2025-54856

Movable Type is affected by a stored XSS in Edit ContentData (CVE-2025-54856). Exploitation requires input stored by a user with ContentType Management privileges, leading to script execution in the browser of users who access the Edit ContentData page. The issue is confirmed in multiple advisori...

CVE-2025-62499: Improper Neutralization of Input During Web Page Generation

Movable Type contains a stored cross-site scripting vulnerability in Edit CategorySet of ContentType page. If crafted input is stored by an attacker with "ContentType Management" privilege, an arbitrary script may be executed on the web browser of the user who accesses Edit CategorySet of...

CVE-2025-54856: Improper Neutralization of Input During Web Page Generation

Movable Type contains a stored cross-site scripting vulnerability in Edit ContentData page. If crafted input is stored by an attacker with "ContentType Management" privilege, an arbitrary script may be executed on the web browser of the user who accesses Edit ContentData page...

Six Apart Movable Type cross-site scripting vulnerability

Six Apart Movable Type is an application from Six Apart USA. Six Apart Movable Type is an application from Six Apart Inc. that provides features such as multiple users, comments, references TrackBack, topics, and more. A cross-site scripting vulnerability exists in Six Apart Movable Type, which...

PT-2025-43429

Name of the Vulnerable Software and Affected Versions Movable Type affected versions not specified Description The software contains a stored cross-site scripting issue in the Edit ContentData page. An attacker with "ContentType Management" privilege can potentially execute arbitrary scripts in a...

PT-2025-43431

Name of the Vulnerable Software and Affected Versions Movable Type affected versions not specified Description The software contains a stored cross-site scripting issue in the Edit CategorySet of ContentType page. An attacker with "ContentType Management" privilege can store crafted input,...

EUVD-2025-35513

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in Ahmad Awais WP Super Edit wp-super-edit allows Reflected XSS.This issue affects WP Super Edit: from n/a through = 2.5.4...

CVE-2025-49948 WordPress WP Super Edit plugin <= 2.5.4 - Cross Site Scripting (XSS) Vulnerability

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in Ahmad Awais WP Super Edit wp-super-edit allows Reflected XSS.This issue affects WP Super Edit: from n/a through = 2.5.4...

CVE-2025-49948 WordPress WP Super Edit plugin <= 2.5.4 - Cross Site Scripting (XSS) Vulnerability

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in Ahmad Awais WP Super Edit wp-super-edit allows Reflected XSS.This issue affects WP Super Edit: from n/a through = 2.5.4...

CVE-2025-49948

CVE-2025-49948 affects the WordPress plugin WP Super Edit (component: wp-super-edit). Connected sources confirm an XSS vulnerability caused by improper neutralization/validation of input during web page generation, enabling reflected XSS in versions up to and including 2.5.4. The issue is describ...

CVE-2025-60790

ProcessWire CMS 3.0.246 allows a low-privileged user with lang-edit to upload a crafted ZIP to Language Support that is auto-extracted without limits prior to validation, enabling resource-exhaustion Denial of Service...