CVE-2025-25054

Summary

CVE-2025-25054 is a reflected cross-site scripting (XSS) vulnerability affecting Movable Type, a content management system. This issue arises when the Multi-Factor authentication plugin is enabled. When a user navigates to a specially crafted page while logged in, an attacker can inject and execute arbitrary scripts in the user's web browser. Successful exploitation allows attackers to gain unauthorized access to sensitive information or take control of the affected user's session. It is crucial for Movable Type users with this plugin enabled to apply the necessary patches as soon as possible to mitigate this risk.

Prevent cyber attacks with Recorded Future by prioritizing and patching critical vulnerabilities being exploited by threat actors targeting your industry. Book your demo to learn more.