CVE-2026-114532

5th percentile - higher than 5% of all known CVEs

The UI Icons module for Drupal contains a Cross-site Scripting (XSS) vulnerability caused by improper neutralization of input during web page generation. The issue affects versions from 0.0.0 to 1.1.3 and from 2.0.0 to 2.0.2.

An attacker can inject a malicious script that executes in users' browsers, potentially leading to session data theft or other actions in the victim's browser context. The risk applies to organizations using this module.

Update the UI Icons module to a version later than 1.1.3 or 2.0.2, depending on the branch in use. Consider deploying security headers that mitigate XSS.