This vulnerability is a reflected cross‑site scripting flaw confined to the admin area of ClipBucket. An attacker can supply a malicious script in the type GET parameter to flagged_item.php, which is then rendered by the admin panel without proper encoding. This could let the attacker execute arbitrary JavaScript in the administrator’s browser, potentially allowing session theft, credential compromise or further lateral movement within the site.

The flaw affects ClipBucket versions v5 up to 5.5.3-#206, as distributed by MacWarrior. No other editions or later releases are listed as impacted.

The CVSS score of 5.1 indicates a moderate risk. Because the vulnerability requires a logged‑in administrator or moderator to reach the affected page, the attack surface is restricted to privileged accounts. The EPSS score is not available, and the issue is not listed in the CISA KEV catalog, suggesting that exploitation has not yet been observed in the wild, but the ability to run arbitrary scripts could still lead to significant damage in a compromised admin account.