CVE-2021-20665: Cross-site scripting vulnerability in in Add asset screen of Contents field of Movable Type 7 r.4705 and earli

Q: How do I fix CVE-2021-20665?

movable type: upgrade to newer than 7.4705; movable type advanced: upgrade to newer than 7.4705; movable type premium: upgrade to newer than 1.39. Exact commands for each OS are on this page.

Q: Is CVE-2021-20665 being exploited?

CVE-2021-20665 is not on the CISA Known Exploited Vulnerabilities list at the time of the last update. Check again, as this can change.

Q: What does CVE-2021-20665 affect?

CVE-2021-20665 affects movable type, movable type advanced, movable type premium. Severity is medium (CVSS 6.1). Cross-site scripting vulnerability in in Add asset screen of Contents field of Movable Type 7 r.4705 and earlier (Movable Type 7 Series), Movable Type Advanced 7 r.4705 and earlier (Movable Type Advanced 7 Series), Movable Type Premium 1.39

Q: How urgent is CVE-2021-20665?

Priority 36/100. No elevated risk signals yet.

Routine

MEDIUM 6.1UPGRADEUPGRADEUPGRADE

CVE-2021-20665 is a medium-severity flaw (CVSS 6.1) affecting movable type, movable type advanced, movable type premium. Below: why it ranks where it does, which versions are affected, what to do, and the exact commands.

Cross-site scripting vulnerability in in Add asset screen of Contents field of Movable Type 7 r.4705 and earlier (Movable Type 7 Series), Movable Type Advanced 7 r.4705 and earlier (Movable Type Advanced 7 Series), Movable Type Premium 1.39 and earlier, and Movable Type Premium Advanced 1.39 and earlier allows remote attackers to inject an arbitrary script via unspecified vectors.

Why this priority

No elevated risk signals yet

A fixed release or distro patch exists.

Risk facts

CVSS score	6.1 (Medium)
Attack vector	Network (remote)
Attack complexity	Low
Privileges needed	None
User interaction	Required
EPSS exploit chance	0.8% (top 42%)
CISA exploited list	No
Weakness	CWE-79
Published	2021-03-05
Last modified	2026-06-17

Publisher (CNA): JPCERT/CC · Vendor: movabletype

Last updated 2026-06-17 · Sources: CVE Program, NVD, CISA KEV, EPSS and vendor advisories · How we score

Am I affected?

Timeline

2021-03-05 10:15 UTCPublished CVE record published
2026-06-17 03:34 UTCUpdated Record last modified

movabletype movable type UPGRADE

Affected: <= 7.4705

Fixed in: newer than 7.4705

Safe to downgrade to: no unaffected older release

1. Check installed version

apt-cache policy movable-type || rpm -q movable-type || movable-type --version

2. UPGRADE to newer than 7.4705 (Debian / Ubuntu)

sudo apt update && sudo apt install --only-upgrade movable-type

2. UPGRADE (RHEL / Amazon Linux / Fedora)

sudo dnf upgrade movable-type

Note

Distros often backport fixes without changing the version number. Confirm with the distro advisory or changelog.

movabletype movable type advanced UPGRADE

Affected: <= 7.4705

Fixed in: newer than 7.4705

Safe to downgrade to: no unaffected older release

1. Check installed version

apt-cache policy movable-type-advanced || rpm -q movable-type-advanced || movable-type-advanced --version

2. UPGRADE to newer than 7.4705 (Debian / Ubuntu)

sudo apt update && sudo apt install --only-upgrade movable-type-advanced

2. UPGRADE (RHEL / Amazon Linux / Fedora)

sudo dnf upgrade movable-type-advanced

Note

Distros often backport fixes without changing the version number. Confirm with the distro advisory or changelog.

movabletype movable type premium UPGRADE

Affected: <= 1.39

Fixed in: newer than 1.39

Safe to downgrade to: no unaffected older release

1. Check installed version

apt-cache policy movable-type-premium || rpm -q movable-type-premium || movable-type-premium --version

2. UPGRADE to newer than 1.39 (Debian / Ubuntu)

sudo apt update && sudo apt install --only-upgrade movable-type-premium

2. UPGRADE (RHEL / Amazon Linux / Fedora)

sudo dnf upgrade movable-type-premium

Note

Distros often backport fixes without changing the version number. Confirm with the distro advisory or changelog.

movabletype movable type premium advanced UPGRADE

Affected: <= 1.39

Fixed in: newer than 1.39

Safe to downgrade to: no unaffected older release

1. Check installed version

apt-cache policy movable-type-premium-advanced || rpm -q movable-type-premium-advanced || movable-type-premium-advanced --version

2. UPGRADE to newer than 1.39 (Debian / Ubuntu)

sudo apt update && sudo apt install --only-upgrade movable-type-premium-advanced

2. UPGRADE (RHEL / Amazon Linux / Fedora)

sudo dnf upgrade movable-type-premium-advanced

Note

Distros often backport fixes without changing the version number. Confirm with the distro advisory or changelog.

Verify at the official source NVD · CVE Program · Report a problem with this page
Scores and fixes here are computed automatically from those and other public sources. Confirm with the vendor advisory before changing production systems.

Quick answers

How do I fix CVE-2021-20665?

movable type: upgrade to newer than 7.4705; movable type advanced: upgrade to newer than 7.4705; movable type premium: upgrade to newer than 1.39. Exact commands for each OS are on this page.

Is CVE-2021-20665 being exploited?

CVE-2021-20665 is not on the CISA Known Exploited Vulnerabilities list at the time of the last update. Check again, as this can change.

What does CVE-2021-20665 affect?

CVE-2021-20665 affects movable type, movable type advanced, movable type premium. Severity is medium (CVSS 6.1). Cross-site scripting vulnerability in in Add asset screen of Contents field of Movable Type 7 r.4705 and earlier (Movable Type 7 Series), Movable Type Advanced 7 r.4705 and earlier (Movable Type Advanced 7 Series), Movable Type Premium 1.39

How urgent is CVE-2021-20665?

Priority 36/100. No elevated risk signals yet.

Related CVEs

CVE-2026-25776 CRITICAL 9.8 UPGRADE Movable Type provided by Six Apart Ltd
CVE-2026-33088 CRITICAL 9.8 UPGRADE Movable Type provided by Six Apart Ltd
CVE-2023-45746 MEDIUM 5.4 UPGRADE Cross-site scripting vulnerability in Movable Type series allows a remote authenticated attacker to inject an
CVE-2022-45122 MEDIUM 6.1 UPGRADE Cross-site scripting vulnerability in Movable Type Movable Type 7 r.5301 and earlier (Movable Type 7 Series),
CVE-2022-45113 MEDIUM 6.5 UPGRADE Improper validation of syntactic correctness of input vulnerability exist in Movable Type series

References

← Back to latest CVEs