Medium severity · published Sep 22, 2026
CVE-2026-95812
ClipBucket v5 before 5.5.3-#182 Reflected XSS via Query Parameters
6.1
CVSS
0.4%
EPSS
No
On KEV
Description
ClipBucket v5 before 5.5.3-#182 contains a reflected cross-site scripting vulnerability in the sort_link() helper function that fails to sanitize cat, sort, and time query parameters. Attackers can craft malicious requests with injected script payloads in these parameters to execute arbitrary JavaScript in victims' browsers under the application origin.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
Required
Confidentiality
Low
Integrity
Low
Availability
None
Scope
Changed
Exploitation
Is it being used?
Exploit prediction (EPSS)0.4% · higher than 29% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
CL
clipbucket-v5 · MacWarrior
before 5.5.3-#182 · source: vendor
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2026-95812
CVE.org
https://www.cve.org/CVERecord?id=CVE-2026-95812
patch
https://github.com/MacWarrior/clipbucket-v5/commit/032f46937e091e22afa6c99f2c888575cc94e44b
release-notes
https://github.com/MacWarrior/clipbucket-v5/releases/tag/5.5.3-%23182
technical-description
https://github.com/MacWarrior/clipbucket-v5/blob/5.5.3-%23153/upload/includes/functions.php
technical-description
https://hackmd.io/@leediay/reflected-xss-in-search-function-clipbucket-v5
product
https://github.com/MacWarrior/clipbucket-v5
third-party-advisory
https://www.vulncheck.com/advisories/clipbucket-v5-before-5.5.3-182-reflected-xss-via-query-parameters
More from clipbucket-v5
9.8
CVE-2026-80138
ClipBucket V5 5.5.1 through 5.5.3-#153 OS Command Injection via Installer php_cli_filepath Parameter
9.8
CVE-2026-45060
ClipBucket: Blind SQL Injection in progress_video.php
9.8
CVE-2026-42846
ClipBucket: Remote Play URL Command Injection
9.8
CVE-2026-21875
ClipBucket v5 Vulnerable to Blind SQL Injection through Channel Comments
9.8
CVE-2025-21624
ClipBucket V5 Playlist Cover File Upload to Remote Code Execution