CVE-2026-110626

ClipBucket v5 through 5.5.3-#206 contains a reflected cross-site scripting vulnerability in admin area/language settings.php via the unencoded edit language GET parameter. Attackers can send administrators with basic settings permission a crafted link whose payload is echoed into a hidden input, executing script in the admin panel origin.