Project: 
UI Icons
Project machine name: 
ui_icons
Date: 
2026-October-21
Security risk: 
Moderately critical 13 ∕ 25 AC:Basic/A:User/CI:Some/II:Some/E:Theoretical/TD:Default
Vulnerability: 
Cross-site scripting
Affected versions: 
<1.1.3 || >=2.0.0 <2.0.2
CVE IDs: 
CVE-2026-114532
Description: 

This module provides a user interface to select and configure icons, including a CKEditor 5 button and widget that embed an icon in formatted text.

Under uncommon situations, the CKEditor 5 widget displays admin-controlled text with appropriate filtering leading to a Cross-site scripting (XSS) vulnerability.

This vulnerability is mitigated by the fact that an attacker must have access to edit content with a text format that allows the UI Icons CKEditor 5 button.

Solution: 

Install the latest version:

UI Icons 1.0.x is not supported. Sites using it should upgrade to UI Icons 1.1.3 or 2.0.2.

Reported By: 
Fixed By: 
Coordinated By: