This vulnerability is a reflected cross‑site scripting flaw confined to the admin area of ClipBucket. An attacker can supply a malicious script in the type GET parameter to flagged_item.php, which is then rendered by the admin panel without proper encoding. This could let the attacker execute arbitrary JavaScript in the administrator’s browser, potentially allowing session theft, credential compromise or further lateral movement within the site.

The flaw affects ClipBucket versions v5 up to 5.5.3-#206, as distributed by MacWarrior. No other editions or later releases are listed as impacted.

The CVSS score of 5.1 indicates a moderate risk. Because the vulnerability requires a logged‑in administrator or moderator to reach the affected page, the attack surface is restricted to privileged accounts. The EPSS score of 0.00393 (just under 0.4%) indicates an extremely low likelihood of exploitation in the wild. The issue is not listed in the CISA KEV catalog, which suggests no known active exploitation has been reported, but the vulnerability still enables arbitrary script execution in the administrator’s browser, potentially leading to session hijacking or further compromise.