The vulnerability is a reflected cross‑site scripting flaw in ClipBucket v5 through 5.5.3‑#206. An attacker can craft a URL containing an unencoded edit_language GET parameter that is echoed back into a hidden input field of the language_settings page. When an administrative user with basic_settings permission opens the link, the arbitrary script runs in the admin panel’s origin, enabling the attacker to steal credentials, hijack the session, or inject malicious content. The flaw is a traditional XSS that does not directly provide remote code execution on the server side.

Affected software is ClipBucket version 5, specifically all releases up to 5.5.3‑#206 distributed by MacWarrior. Administrators using this version with basic_settings rights are potential victims.

The CVSS score of 5.1 indicates a moderate impact. No EPSS score is available, and the vulnerability is not listed in the CISA KEV catalog. Attackers must provide a crafted link to an admin with appropriate permission, so the attack vector requires user interaction. While the exploit is not highly likely in the field, the moderate severity and administrative privilege escalation potential mean the vulnerability should be addressed promptly.