Live › vulnerability › CVE-2026-110504
The Enable SVG, WebP, and ICO Upload WordPress plugin before 1.1.6 stores and serves uploaded SVG files without sanitizing those whose content is not detected as SVG. A user with the author role or higher can plant script in an uploaded image that runs in other visitors' browsers.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-29 06:53 UTC. All times on this page are UTC.
Sites running the Enable SVG, WebP, and ICO Upload WordPress plugin before 1.1.6 where users with the author role or higher can upload media. Sites without this plugin, or where only trusted administrators can upload, are less exposed. unknown for further detail.
No product ranges from the sources yet.
wp-content/plugins/ for the plugin's main file header.1.1.6 or later (fixed version as stated in the advisory's affected range).Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
The Enable SVG, WebP, and ICO Upload WordPress plugin before 1.1.6 does not sanitize uploaded SVG files whose content is not detected as SVG, while still storing and serving them as SVG images, which could allow users with the author role and above to perform Stored Cross-Site Scripting attacks.
This page as .md · .json · in your agent: get_signal("CVE-2026-110504")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.