Security Alert Summary
The Enable SVG, WebP, and ICO Upload WordPress plugin (versions before 1.1.6) does not prevent animation elements in uploaded SVG files from changing a link’s target to a javascript: URI. This can allow authenticated users with the author role and above to bypass the plugin’s SVG sanitization and perform stored cross-site scripting (XSS) that executes in WebKit-based browsers such as Safari.
CVE Details
- CVE ID: CVE-2026-110505
- Affected component: Enable SVG, WebP, and ICO Upload WordPress plugin
- Affected versions: Versions less than 1.1.6 (before 1.1.6)
- Published: October 29, 2026 at 6:17:18 AM UTC
- Last modified: October 29, 2026 at 3:18:27 PM UTC
- CVSS v3.1: Base Score 6.8, Severity MEDIUM, Vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:H/I:H/A:H
- Authentication / privileges / user interaction: Requires an authenticated user with elevated privileges (author role and above). CVSS indicates Privileges Required: HIGH; User Interaction: REQUIRED.
- Primary impact: Confidentiality: HIGH; Integrity: HIGH; Availability: HIGH
- CWE: CWE-79 (Cross-site Scripting)
Technical Details
The plugin fails to prevent animation elements in uploaded SVG files from altering a link’s target to a javascript: URI. Because those animation elements can modify link targets, an attacker who can upload SVGs and has the author role or higher can store payloads that execute as cross-site scripting when rendered in WebKit-based browsers (for example, Safari). The issue arises from insufficient SVG sanitization that does not block this specific vector.
The result is stored XSS: malicious content uploaded to the site is saved on the server and later executed in the browser of any user who views the affected page in a vulnerable browser.
How This Could Impact Your Website
Consider a site where the site owner manages plugins, internal staff publish content, and an external contractor uploads images or SVG assets. If a user with author-level access or higher uploads a crafted SVG, the stored XSS could run in the browser of other staff or site administrators who view the page in a WebKit-based browser. Practical consequences include unauthorized execution of script in those users’ browsers, which could be used to read page content or session-visible data and increase the risk of targeted phishing or social engineering against staff.
This does not necessarily imply full host or site compromise, but it can expose sensitive data present in the browser context and enable further targeted attacks against privileged users. If you’re unsure whether your site is affected or how to assess your current user roles and plugins, it may be worth having a professional review of your setup.
Recommended Actions
- Update the affected plugin as soon as a patched version is available.
- Restrict who can upload SVGs and other media to trusted users only; limit author-level privileges where possible.
- Review and reduce unnecessary user roles, especially author and contributor roles that permit uploads.
- Enforce strong passwords and two-factor authentication for editors and administrators.
- Remove unused or unmaintained plugins and media handlers.
- Monitor site activity and logs for unusual upload behavior or unexpected content changes.
If you’d like help reviewing your plugins, user roles, or overall WordPress security posture, our team at Freshy is happy to help.
