The philspectrum Icon Widget up to version 1.1.0 suffers from a DOM-based XSS vulnerability due to improper input neutralization during web page generation. This allows attackers with at least low privileges and requiring user interaction to execute arbitrary scripts, potentially impacting confidentiality, integrity, and availability of affected systems. The vulnerability is network exploitable and affects the widget when embedded in web pages.

Successful exploitation could lead to partial compromise of confidentiality, integrity, and availability of the affected web application or user session. The attack requires user interaction and low privileges, and it can be triggered remotely over the network. No known active exploitation has been reported.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, users should consider disabling or removing the vulnerable Icon Widget or applying any recommended temporary mitigations from the vendor. Monitor the vendor's communications for updates on patches or workarounds.