The issue is related to Stored Cross-Site Scripting in the Icon Widget due to insufficient input sanitization and output escaping. This allows authenticated attackers with contributor-level access and above to inject arbitrary web scripts in pages via the `fl builder data[node preview][link]` and `fl builder data[settings][link target]` parameters. These scripts will execute whenever a user accesses an injected page.