{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-21393", "assignerOrgId": "ede6fdc4-6654-4307-a26d-3331c018e2ce", "state": "PUBLISHED", "assignerShortName": "jpcert", "dateReserved": "2026-01-29T02:02:32.381Z", "datePublished": "2026-02-04T07:02:50.465Z", "dateUpdated": "2026-02-04T16:08:26.340Z"}, "containers": {"cna": {"affected": [{"vendor": "Six Apart Ltd.", "product": "Movable Type (Software Edition)", "versions": [{"version": "9.0.4 to 9.0.5 (9.0 series)", "status": "affected"}, {"version": "8.8.0 to 8.8.1 (8.8 series)", "status": "affected"}, {"version": "8.0.2 to 8.0.8 (8.0 series)", "status": "affected"}]}, {"vendor": "Six Apart Ltd.", "product": "Movable Type Advanced (Software Edition)", "versions": [{"version": "9.0.4 to 9.0.5 (9.0 series)", "status": "affected"}, {"version": "8.8.0 to 8.8.1 (8.8 series)", "status": "affected"}, {"version": "8.0.2 to 8.0.8 (8.0 series)", "status": "affected"}]}, {"vendor": "Six Apart Ltd.", "product": "Movable Type Premium (Software Edition)", "versions": [{"version": "9.0.4 (MTP 9.0 series)", "status": "affected"}, {"version": "2.13 and earlier (MTP 2 series)", "status": "affected"}]}, {"vendor": "Six Apart Ltd.", "product": "Movable Type Premium (Advanced Edition) (Software Edition)", "versions": [{"version": "9.0.4 (MTP 9.0 series)", "status": "affected"}, {"version": "2.13 and earlier (MTP 2 series)", "status": "affected"}]}, {"vendor": "Six Apart Ltd.", "product": "Movable Type (Cloud Edition)", "versions": [{"version": "9.0.5 (9 series)", "status": "affected"}, {"version": "8.8.1 (8 series)", "status": "affected"}]}, {"vendor": "Six Apart Ltd.", "product": "Movable Type Premium (Cloud Edition)", "versions": [{"version": "9.0.5 (9 series)", "status": "affected"}, {"version": "2.12 (MTP 2 series)", "status": "affected"}]}], "descriptions": [{"lang": "en", "value": "Movable Type contains a stored cross-site scripting vulnerability in Edit Comment. If crafted input is stored by an attacker, arbitrary script may be executed on a logged-in user's web browser. Note that Movable Type 7 series and 8.4 series, which are End-of-Life (EOL), are affected by the vulnerability as well."}], "problemTypes": [{"descriptions": [{"description": "Cross-site scripting (XSS)", "lang": "en-US", "cweId": "CWE-79", "type": "CWE"}]}], "references": [{"url": "https://movabletype.org/news/2026/02/mt-906-released.html"}, {"url": "https://www.sixapart.jp/movabletype/news/2026/02/04-1100.html"}, {"url": "https://jvn.jp/en/jp/JVN45405689/"}], "metrics": [{"format": "CVSS", "scenarios": [{"lang": "en-US", "value": "GENERAL"}], "cvssV3_0": {"version": "3.0", "baseSeverity": "MEDIUM", "baseScore": 5.4, "vectorString": "CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N"}}, {"format": "CVSS", "scenarios": [{"lang": "en-US", "value": "GENERAL"}], "cvssV4_0": {"version": "4.0", "baseSeverity": "MEDIUM", "baseScore": 4.8, "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:A/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N"}}], "providerMetadata": {"orgId": "ede6fdc4-6654-4307-a26d-3331c018e2ce", "shortName": "jpcert", "dateUpdated": "2026-02-04T07:02:50.465Z"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-02-04T16:08:19.248184Z", "id": "CVE-2026-21393", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-02-04T16:08:26.340Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-21393", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-02-04T16:08:19.248184Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-02-04T16:08:22.360Z"}}], "cna": {"metrics": [{"format": "CVSS", "cvssV3_0": {"version": "3.0", "baseScore": 5.4, "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N"}, "scenarios": [{"lang": "en-US", "value": "GENERAL"}]}, {"format": "CVSS", "cvssV4_0": {"version": "4.0", "baseScore": 4.8, "baseSeverity": "MEDIUM", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:A/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N"}, "scenarios": [{"lang": "en-US", "value": "GENERAL"}]}], "affected": [{"vendor": "Six Apart Ltd.", "product": "Movable Type (Software Edition)", "versions": [{"status": "affected", "version": "9.0.4 to 9.0.5 (9.0 series)"}, {"status": "affected", "version": "8.8.0 to 8.8.1 (8.8 series)"}, {"status": "affected", "version": "8.0.2 to 8.0.8 (8.0 series)"}]}, {"vendor": "Six Apart Ltd.", "product": "Movable Type Advanced (Software Edition)", "versions": [{"status": "affected", "version": "9.0.4 to 9.0.5 (9.0 series)"}, {"status": "affected", "version": "8.8.0 to 8.8.1 (8.8 series)"}, {"status": "affected", "version": "8.0.2 to 8.0.8 (8.0 series)"}]}, {"vendor": "Six Apart Ltd.", "product": "Movable Type Premium (Software Edition)", "versions": [{"status": "affected", "version": "9.0.4 (MTP 9.0 series)"}, {"status": "affected", "version": "2.13 and earlier (MTP 2 series)"}]}, {"vendor": "Six Apart Ltd.", "product": "Movable Type Premium (Advanced Edition) (Software Edition)", "versions": [{"status": "affected", "version": "9.0.4 (MTP 9.0 series)"}, {"status": "affected", "version": "2.13 and earlier (MTP 2 series)"}]}, {"vendor": "Six Apart Ltd.", "product": "Movable Type (Cloud Edition)", "versions": [{"status": "affected", "version": "9.0.5 (9 series)"}, {"status": "affected", "version": "8.8.1 (8 series)"}]}, {"vendor": "Six Apart Ltd.", "product": "Movable Type Premium (Cloud Edition)", "versions": [{"status": "affected", "version": "9.0.5 (9 series)"}, {"status": "affected", "version": "2.12 (MTP 2 series)"}]}], "references": [{"url": "https://movabletype.org/news/2026/02/mt-906-released.html"}, {"url": "https://www.sixapart.jp/movabletype/news/2026/02/04-1100.html"}, {"url": "https://jvn.jp/en/jp/JVN45405689/"}], "descriptions": [{"lang": "en", "value": "Movable Type contains a stored cross-site scripting vulnerability in Edit Comment. If crafted input is stored by an attacker, arbitrary script may be executed on a logged-in user's web browser. Note that Movable Type 7 series and 8.4 series, which are End-of-Life (EOL), are affected by the vulnerability as well."}], "problemTypes": [{"descriptions": [{"lang": "en-US", "type": "CWE", "cweId": "CWE-79", "description": "Cross-site scripting (XSS)"}]}], "providerMetadata": {"orgId": "ede6fdc4-6654-4307-a26d-3331c018e2ce", "shortName": "jpcert", "dateUpdated": "2026-02-04T07:02:50.465Z"}}}, "cveMetadata": {"cveId": "CVE-2026-21393", "state": "PUBLISHED", "dateUpdated": "2026-02-04T16:08:26.340Z", "dateReserved": "2026-01-29T02:02:32.381Z", "assignerOrgId": "ede6fdc4-6654-4307-a26d-3331c018e2ce", "datePublished": "2026-02-04T07:02:50.465Z", "assignerShortName": "jpcert"}, "dataVersion": "5.2"}

{"cveTags": [], "descriptions": [{"lang": "en", "value": "Movable Type contains a stored cross-site scripting vulnerability in Edit Comment. If crafted input is stored by an attacker, arbitrary script may be executed on a logged-in user's web browser. Note that Movable Type 7 series and 8.4 series, which are End-of-Life (EOL), are affected by the vulnerability as well."}, {"lang": "es", "value": "Movable Type contiene una vulnerabilidad de cross-site scripting almacenado en Edit Comment. Si una entrada manipulada es almacenada por un atacante, se puede ejecutar script arbitrario en el navegador web de un usuario que ha iniciado sesi\u00f3n. Tenga en cuenta que las series Movable Type 7 y 8.4, que est\u00e1n al final de su vida \u00fatil (EOL), tambi\u00e9n se ven afectadas por la vulnerabilidad."}], "id": "CVE-2026-21393", "lastModified": "2026-04-15T00:35:42.020", "metrics": {"cvssMetricV30": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 5.4, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "privilegesRequired": "LOW", "scope": "CHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N", "version": "3.0"}, "exploitabilityScore": 2.3, "impactScore": 2.7, "source": "vultures@jpcert.or.jp", "type": "Secondary"}], "cvssMetricV40": [{"cvssData": {"Automatable": "NOT_DEFINED", "Recovery": "NOT_DEFINED", "Safety": "NOT_DEFINED", "attackComplexity": "LOW", "attackRequirements": "NONE", "attackVector": "NETWORK", "availabilityRequirement": "NOT_DEFINED", "baseScore": 4.8, "baseSeverity": "MEDIUM", "confidentialityRequirement": "NOT_DEFINED", "exploitMaturity": "NOT_DEFINED", "integrityRequirement": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "privilegesRequired": "LOW", "providerUrgency": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "subConfidentialityImpact": "LOW", "subIntegrityImpact": "LOW", "userInteraction": "ACTIVE", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:A/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "version": "4.0", "vulnAvailabilityImpact": "NONE", "vulnConfidentialityImpact": "NONE", "vulnIntegrityImpact": "NONE", "vulnerabilityResponseEffort": "NOT_DEFINED"}, "source": "vultures@jpcert.or.jp", "type": "Secondary"}]}, "published": "2026-02-04T07:16:01.027", "references": [{"source": "vultures@jpcert.or.jp", "url": "https://jvn.jp/en/jp/JVN45405689/"}, {"source": "vultures@jpcert.or.jp", "url": "https://movabletype.org/news/2026/02/mt-906-released.html"}, {"source": "vultures@jpcert.or.jp", "url": "https://www.sixapart.jp/movabletype/news/2026/02/04-1100.html"}], "sourceIdentifier": "vultures@jpcert.or.jp", "vulnStatus": "Deferred", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-79"}], "source": "vultures@jpcert.or.jp", "type": "Primary"}]}

{}

{"analysis": {"en": {"generated_at": "2026-04-17T23:52:53.663512+00:00", "value": {"mitigation_remediation": ["Apply the latest Movable\u00a0Type update (MT\u202f906) to remove the vulnerability", "If an update cannot be deployed immediately, restrict or disable the comment editing feature for non\u2011trusted users", "Implement server\u2011side content filtering for edited comments, ensuring all output is properly escaped", "Monitor user-generated content for suspicious script payloads and review access logs for any anomalous activity"], "summary": {"action": "Patch Now", "impact": "Stored cross\u2011site scripting allowing arbitrary script execution in a logged\u2011in user's browser"}, "threat_synthesis": {"affected_systems": "All Six\u00a0Apart Movable\u00a0Type deployments, including the Cloud Edition, Software Edition, Advanced Edition, and Premium Edition. The flaw is confirmed in the 7\u00a0series and 8.4\u00a0series releases, which are already End\u2011of\u2010Life. Any other current releases are likely affected until a patch is applied, because the underlying edit-comment processing has not been altered.", "description_and_impact": "Movable\u00a0Type implements a stored cross\u2011site scripting flaw in the Edit\u202fComment feature. When an attacker supplies crafted input that gets saved, every user who later views the comment while logged in will have that script run in their browser. The vulnerability directly compromises the integrity of the user experience and can be leveraged for malicious activities such as session hijacking or data exfiltration within the scope of the trusted user session.", "risk_and_exploitability": "The CVSS score of 4.8 reflects a medium severity vulnerability, while the EPSS figure of below 1\u202f% indicates a low likelihood of exploitation at present. The issue is not yet cataloged by CISA\u2019s KEV list. Attackers could exploit the flaw by posting a malicious comment or by injecting script into an existing comment\u2014any logged\u2011in user who views the comment will have the code executed. No remote code execution beyond the browser context is necessary, but the impact is significant for users with privileged accounts."}}}}, "created": "2026-02-04T21:18:12.933995+00:00", "title": "Stored XSS in Movable\u00a0Type Comment Editing Allows Script Execution", "updated": "2026-04-18T00:00:09.477418+00:00", "vendors": ["six_apart", "six_apart$PRODUCT$movable_type", "six_apart_ltd", "six_apart_ltd$PRODUCT$movable_type"]}