CVE-2026-114532

This module provides a user interface to select and configure icons, including a CKEditor 5 button and widget that embed an icon in formatted text.

Under uncommon situations, the CKEditor 5 widget displays admin-controlled text with appropriate filtering leading to a Cross-site scripting (XSS) vulnerability.

This vulnerability is mitigated by the fact that an attacker must have access to edit content with a text format that allows the UI Icons CKEditor 5 button.