---
id: "CVE-2026-110504"
kind: "vulnerability"
aliases: ["CVE-2026-110504"]
title: "WordPress SVG upload plugin: unsanitized uploads enable stored cross-site scripting"
severity: "medium"
cvss: null
epss: null
exploited: false
status: "open"
category: "package"
products: []
ecosystems: []
tags: ["package", "self-hosted", "wordpress", "wordpress-plugin"]
not_affected_if: ["no-untrusted-authors", "plugin-1.1.6-or-later", "plugin-not-installed"]
published_at: "2026-10-29T06:17:18+00:00"
first_seen_at: "2026-10-29T06:53:13+00:00"
updated_at: "2026-10-29T06:54:55+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-110504", "first_seen_at": "2026-10-29T06:53:13+00:00"}]
---

# WordPress SVG upload plugin: unsanitized uploads enable stored cross-site scripting

The Enable SVG, WebP, and ICO Upload WordPress plugin before 1.1.6 stores and serves uploaded SVG files without sanitizing those whose content is not detected as SVG. A user with the author role or higher can plant script in an uploaded image that runs in other visitors' browsers.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Check the installed plugin version in the WordPress admin under Plugins, or in `wp-content/plugins/` for the plugin's main file header.
- Look for the plugin's uploads handling for SVG files that do not pass SVG detection.

## Fix

- Enable SVG, WebP, and ICO Upload: `1.1.6` or later (fixed version as stated in the advisory's affected range).

## Timeline

- 2026-10-29T06:53:13+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-110504

## From the sources

The Enable SVG, WebP, and ICO Upload WordPress plugin before 1.1.6 does not sanitize uploaded SVG files whose content is not detected as SVG, while still storing and serving them as SVG images, which could allow users with the author role and above to perform Stored Cross-Site Scripting attacks.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_