Vulnerability DRUPAL-CONTRIB-2026-230
Unknown
UNKNOWN RISK
Vulnerabilities without an assigned CVSS score. Severity is not determinable from available data.
2 hours ago
October 21, 2026 at 05:44 PM UTC
No summary available
<1.1.3, >=2.0.0 <2.0.2
<1.1.3, >=2.0.0 <2.0.2
Details
This module provides a user interface to select and configure icons, including a CKEditor 5 button and widget that embed an icon in formatted text.
Under uncommon situations, the CKEditor 5 widget displays admin-controlled text with appropriate filtering leading to a Cross-site scripting (XSS) vulnerability.
This vulnerability is mitigated by the fact that an attacker must have access to edit content with a text format that allows the UI Icons CKEditor 5 button.
References
Related Vulnerabilities
Other vulnerabilities affecting the same packages
Unknown
2 hours ago
No summary available
<1.1.3, >=2.0.0 <2.0.2 DRUPAL-CONTRIB-2026-221
<1.1.3, >=2.0.0 <2.0.2 DRUPAL-CONTRIB-2026-221
Unknown
8 months ago
No summary available
<1.0.1, >=1.1.0 <1.1.1 DRUPAL-CONTRIB-2026-010
<1.0.1, >=1.1.0 <1.1.1 DRUPAL-CONTRIB-2026-010
Impacted packages
Timeline
Published
2 hours ago
October 21, 2026 at 05:44 PM UTC
Last Modified
2 hours ago
October 21, 2026 at 06:15 PM UTC