Skip to content
Sign in
6.8 Medium

CVE-2026-110504 The Enable SVG, WebP, and ICO Upload WordPress plugin before 1.1.6 does not sanitize uploaded SVG files whose content is…

Description

The Enable SVG, WebP, and ICO Upload WordPress plugin before 1.1.6 does not sanitize uploaded SVG files whose content is not detected as SVG, while still storing and serving them as SVG images, which could allow users with the author role and above to perform Stored Cross-Site Scripting attacks.

Affected products and versions

Product Affected versions Fixed in
Enable SVG, WebP, and ICO Upload 1.1 1.1.3 → < 1.1.6 1.1.6

Other CVEs of Enable SVG, WebP, and ICO Upload

The 2 CVEs of Enable SVG, WebP, and ICO Upload →
CVE-2026-110505 The Enable SVG, WebP, and ICO Upload WordPress plugin before 1.1.6 does not prevent animation elements in uploaded SVG… 6.8 Medium
Track this CVE