{"id":"CVE-2026-110504","kind":"vulnerability","aliases":["CVE-2026-110504"],"related":[],"title":"WordPress SVG upload plugin: unsanitized uploads enable stored cross-site scripting","description":"The Enable SVG, WebP, and ICO Upload WordPress plugin before 1.1.6 does not sanitize uploaded SVG files whose content is not detected as SVG, while still storing and serving them as SVG images, which could allow users with the author role and above to perform Stored Cross-Site Scripting attacks.","summary":"The Enable SVG, WebP, and ICO Upload WordPress plugin before 1.1.6 stores and serves uploaded SVG files without sanitizing those whose content is not detected as SVG. A user with the author role or higher can plant script in an uploaded image that runs in other visitors' browsers.","severity":"medium","cvss":null,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["package","self-hosted","wordpress","wordpress-plugin"],"not_affected_if":["no-untrusted-authors","plugin-1.1.6-or-later","plugin-not-installed"],"how_to_check":"- Check the installed plugin version in the WordPress admin under Plugins, or in `wp-content/plugins/` for the plugin's main file header.\n- Look for the plugin's uploads handling for SVG files that do not pass SVG detection.","fix":"- Enable SVG, WebP, and ICO Upload: `1.1.6` or later (fixed version as stated in the advisory's affected range).","status":"open","published_at":"2026-10-29T06:17:18+00:00","first_seen_at":"2026-10-29T06:53:13+00:00","triaged_at":"2026-10-29T06:54:55+00:00","updated_at":"2026-10-29T06:54:55+00:00","category":"package","confidence":0.6,"triage":{"at":"2026-10-29T06:54:55Z","model":"claude-haiku-5-5","output":{"fix":"- Enable SVG, WebP, and ICO Upload: `1.1.6` or later (fixed version as stated in the advisory's affected range).","reach":"network","title":"WordPress SVG upload plugin: unsanitized uploads enable stored cross-site scripting","impact":"medium","summary":"The Enable SVG, WebP, and ICO Upload WordPress plugin before 1.1.6 stores and serves uploaded SVG files without sanitizing those whose content is not detected as SVG. A user with the author role or higher can plant script in an uploaded image that runs in other visitors' browsers.","audience":"businesses","category":"package","nicknames":[],"who_cares":["wordpress","wordpress-plugin","self-hosted"],"confidence":0.6,"fix_status":"available","needs_auth":"yes","worst_case":"Stored script runs in visitors' and admins' browsers on the site","analyst_note":"","how_to_check":"- Check the installed plugin version in the WordPress admin under Plugins, or in `wp-content/plugins/` for the plugin's main file header.\n- Look for the plugin's uploads handling for SVG files that do not pass SVG detection.","plain_action":"","needs_analyst":false,"not_affected_if":["plugin-not-installed","plugin-1.1.6-or-later","no-untrusted-authors"],"who_is_affected":"Sites running the Enable SVG, WebP, and ICO Upload WordPress plugin before 1.1.6 where users with the author role or higher can upload media. Sites without this plugin, or where only trusted administrators can upload, are less exposed. unknown for further detail.","user_interaction":"yes","needs_special_setup":"no","severity_if_unknown":"medium"},"cost_usd":0.000713,"input_tokens":4136,"output_tokens":599,"severity_before":"unknown"},"analyst_status":null,"analyst_note":null,"search":"'-110504':15A,18A '-2026':14A,17A '1.1.6':37B,85C 'allow':110C 'attack':125C 'author':58B,114C 'browser':74B 'content':48B,93C 'could':109C 'cross':10A,122C 'cross-sit':9A,121C 'cve':13A,16A 'detect':51B,96C 'enabl':7A,28B,76C 'file':43B,91C 'higher':61B 'host':22B 'ico':32B,80C 'imag':68B,107C 'packag':19B 'perform':119C 'plant':63B 'plugin':4A,26B,35B,83C 'role':59B,115C 'run':70B 'sanit':45B,88C 'script':12A,64B,124C 'self':21B 'self-host':20B 'serv':40B,103C 'site':11A,123C 'still':100C 'store':8A,38B,101C,120C 'svg':2A,29B,42B,53B,77C,90C,98C,106C 'unsanit':5A 'upload':3A,6A,33B,41B,67B,81C,89C 'user':55B,111C 'visitor':73B 'webp':30B,78C 'whose':47B,92C 'without':44B 'wordpress':1A,23B,25B,34B,82C 'wordpress-plugin':24B","nicknames":[],"mitigations":[],"who_affected":"Sites running the Enable SVG, WebP, and ICO Upload WordPress plugin before 1.1.6 where users with the author role or higher can upload media. Sites without this plugin, or where only trusted administrators can upload, are less exposed. unknown for further detail.","tier":"C","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"businesses","plain_action":null,"first_public_at":"2026-10-29T06:17:18+00:00","kev":null,"cvss_vector":null,"cvss_by":null,"poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-110504","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-110504","severity":null,"published_at":"2026-10-29T06:17:18+00:00","modified_at":"2026-10-29T06:17:18+00:00","first_seen_at":"2026-10-29T06:53:13+00:00","fetched_at":"2026-10-29T06:53:13+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}