The flaw is a reflected cross‑site scripting weakness in the sort_link() helper of ClipBucket v5. The function does not escape or validate the 'cat', 'sort', and 'time' query parameters, allowing an attacker to embed JavaScript in an HTTP request. When a victim views a page with these injected parameters, the malicious script runs in the victim’s browser under the ClipBucket origin. This client‑side code execution can be used for phishing, session hijacking, or other client‑side attacks and is classified as CWE‑79.

The vulnerability affects all MacWarrior ClipBucket v5 releases older than version 5.5.3‑#182. The particular code path is the sort_link() helper defined in upload/includes/functions.php, as documented in the fix commit. No additional vendors or product variants are listed as impacted.

The CVSS score of 5.3 indicates medium overall risk; no EPSS score is available, and the vulnerability is not listed in the CISA KEV catalog, suggesting limited exploitation evidence. Exploitation can be carried out solely by sending a crafted HTTP GET request with malicious query parameters, making the attack vector web‑based. The impact is confined to client browsers, but an attacker can steal session cookies, deface pages, or carry out social‑engineering attacks. Although the vulnerability has not been widely abused, its medium severity and ability to harm users warrant timely remediation.