Jean Valverde

Improper neutralization of input during web page generation allows Cross-Site Scripting (XSS). The module fails to sufficiently validate icon settings provided by users before they are rendered.

Improper neutralization of input during web page generation leads to Cross-site Scripting (XSS) in the CKEditor 5 widget. This occurs when the widget displays admin-controlled text with insufficient filtering. Exploitation requires the attacker to have permissions to edit content using a text format that enables the UI Icons CKEditor 5 button.

A flaw exists in Drupal UI Icons that allows for Cross-Site Scripting (XSS). The issue stems from insufficient sanitization of user input during web page generation. The vulnerability is present when the "UI Icons for CKEditor 5" submodule is enabled.