ClipBucket v5 allows a normal authenticated user to store a malicious script in the name of a collection. The payload is executed when an administrator loads or edits the collection, resulting in stored cross‑site scripting that runs within the admin’s browser context. This can lead to theft of authentication cookies, session hijacking, or defacement of the admin interface, thereby compromising the confidentiality and integrity of sensitive administrative sessions.

The vulnerability is present in MacWarrior’s ClipBucket v5, affecting any installation running a version earlier than 5.5.3 #59. The affected product is the open‑source video sharing platform delivered under the CPE for oxygenz:clipbucket. Versions prior to the 5.5.3 #59 release are susceptible.

The base CVSS score is 2.0, indicating low severity. The EPSS score is below 1 %, suggesting a very low probability of exploitation at the time of analysis. The vulnerability is not listed in the CISA KEV catalog. Attack execution requires the attacker to be an authenticated regular user to store the payload, and the triggering action demands an admin to view or edit the malicious collection name, meaning the exploit depends on privileged access to the admin interface and user input handling in the collection name field.