Moderator Toolbox before version 4.0.14 has a stored cross‑site scripting flaw in the removalreasons module. User‑controlled values for fields such as pmsubject, header, or reason titles are inserted into popup HTML without proper encoding, allowing attackers to inject arbitrary JavaScript that executes with the privileges of any moderator viewing the page. The flaw can be leveraged to steal session cookies or perform actions under a moderator’s account, representing a classic example of CWE‑79 where reflected input is not sanitized.

The affected product is the Reddit Moderator Toolbox released by toolbox‑team. All installations using a version earlier than 4.0.14 are vulnerable, specifically those that expose subreddit‑wide removalreasons configuration to wiki edits. No other versions or components were reported as affected.

The CVSS score of 5.1 indicates moderate severity. Attackers who can edit the toolbox wiki page can introduce malicious code, making the attack vector likely internal or based on sub‑reddit trust relationships rather than external network access. The EPSS score is not available, and the vulnerability is not listed in the CISA KEV catalog. Though it does not provide remote code execution on the host, it can compromise moderator accounts and indirectly allow privileged actions on Reddit.