CVE-2026-110626: ClipBucket v5 through 5.5.3-#206 Reflected XSS via edit_language in language_settings.php

Q: Which users are at risk from a crafted link?

Administrators who have the basic_settings permission are the target population. The payload executes in the admin panel's origin when such an administrator opens the crafted link.

Q: Does exploitation require authentication or user interaction?

The attacker does not need privileges, but must persuade an administrator with basic_settings permission to visit a crafted URL. The vulnerable input is the edit_language GET parameter.

Q: Which releases are known to be affected?

ClipBucket v5 through 5.5.3-#206 are identified as affected.

Published Oct 14, 2026

Updated

ClipBucket v5 through 5.5.3-#206 contains a reflected cross-site scripting vulnerability in adminarea/languagesettings.php via the unencoded editlanguage GET parameter. Attackers can send administrators with basicsettings permission a crafted link whose payload is echoed into a hidden input, executing script in the admin panel origin.

Affected Software

1 affected component

ClipBucket ClipBucket>=5<=5.5.3-#206

Event History

Oct 14, 2026

CVE Published

via MITRE·02:17 PM

Data Sourced

via MITRE·02:17 PM

DescriptionSeverityWeakness

Frequently Asked Questions

Which users are at risk from a crafted link?

Administrators who have the basic_settings permission are the target population. The payload executes in the admin panel's origin when such an administrator opens the crafted link.

Does exploitation require authentication or user interaction?

The attacker does not need privileges, but must persuade an administrator with basic_settings permission to visit a crafted URL. The vulnerable input is the edit_language GET parameter.

Which releases are known to be affected?