Signal is active with 2 mentions in latest observed window
Recommended action window: Monitor and triage in normal cycle
NVD description
Movable Type contains a stored cross-site scripting vulnerability in Export Sites. If crafted input is stored by an attacker, arbitrary script may be executed on a logged-in user's web browser. Note that Movable Type 7 series and 8.4 series, which are End-of-Life (EOL), are affected by the vulnerability as well.
Priority
LOW
Exploitation
NONE
PoC
NONE
Patch
NONE
Momentum
NONE
CVE-2026-22875 Stored Cross-Site Scripting Vulnerability in Movable Type Export Sites https://vulmon.com/vulnerabilitydetails?qid=CVE-2026-22875
Post summary
A stored XSS vulnerability (CVE-2026-22875) affecting Movable Type export sites has been disclosed, with limited technical detail and no PoC or exploitation evidence available.
CVE-2026-22875 Movable Type contains a stored cross-site scripting vulnerability in Export Sites. If crafted input is stored by an attacker, arbitrary script may be executed on a lo… https://www.cve.org/CVERecord?id=CVE-2026-22875
Post summary
A stored XSS vulnerability in Movable Type’s Export Sites feature allows attackers to store crafted input that executes arbitrary scripts. The flaw is newly disclosed with no known patches or active exploitation reported.