CVE-2026-110504 in Enable SVG, WebP, and ICO Upload Plugin
Summary
by MITRE • 10/29/2026
The Enable SVG, WebP, and ICO Upload WordPress plugin before 1.1.6 does not sanitize uploaded SVG files whose content is not detected as SVG, while still storing and serving them as SVG images, which could allow users with the author role and above to perform Stored Cross-Site Scripting attacks.
VulDB is the best source for vulnerability data and more expert information about this specific topic.
Analysis
by VulDB Data Team • 10/29/2026
The vulnerability identified in versions of the Enable SVG, WebP, and ICO Upload plugin for WordPress prior to version 1.1.6 represents a critical security flaw rooted in inadequate input validation and sanitization mechanisms. Specifically, the application fails to properly sanitize uploaded Scalable Vector Graphics files when their content does not match the expected MIME type or file signature detection logic. This discrepancy allows attackers who possess author-level permissions or higher within the WordPress environment to bypass standard security checks by uploading maliciously crafted SVG files that are stored and subsequently served as valid SVG images despite containing non-conforming data structures.
From a technical perspective, this flaw constitutes an improper input validation issue where the application relies on superficial file type detection rather than rigorous content sanitization. When an attacker uploads an SVG file with embedded JavaScript or other executable code elements, the plugin stores the file without stripping these dangerous components because the internal logic does not recognize the payload as invalid based on its initial heuristic checks. Consequently, when a victim user views the page containing this uploaded image, the browser interprets and executes the malicious script within the context of the website's domain. This behavior aligns with CWE-20 Improper Input Validation and CWE-79 Cross-site Scripting: Stored, as the vulnerability allows for the persistence of hostile scripts on the server side which are then delivered to unsuspecting users.
The operational impact of this stored cross-site scripting attack is severe, particularly given that it requires only author-level privileges rather than full administrative access. An attacker with such permissions can inject malicious code into any page or post where images are displayed. Once executed, the script can perform a variety of harmful actions including stealing session cookies to hijack user sessions, redirecting users to phishing sites, defacing web content, or executing arbitrary commands if combined with other vulnerabilities like cross-site request forgery weaknesses in the target application. This undermines the integrity and confidentiality of both the website and its visitors, potentially leading to significant reputational damage and data breaches.
To mitigate this risk, immediate action is required by upgrading the Enable SVG, WebP, and ICO Upload plugin to version 1.1.6 or later where these sanitization issues have been addressed. Administrators should also implement strict file upload policies that enforce server-side validation of MIME types against actual content signatures rather than relying solely on client-side checks or simple extensions. Additionally, deploying a web application firewall can provide an additional layer of defense by filtering out malicious payloads before they reach the application logic. Regular security audits and penetration testing focused on media handling components are recommended to identify similar vulnerabilities in other plugins that manage file uploads within the WordPress ecosystem.