CVE-2026-110505 in Enable SVG
Summary
by MITRE • 10/29/2026
The Enable SVG, WebP, and ICO Upload WordPress plugin before 1.1.6 does not prevent animation elements in uploaded SVG files from changing a link's target to a javascript: URI, which could allow users with the author role and above to bypass its SVG sanitization and perform Stored Cross-Site Scripting attacks that execute in WebKit-based browsers such as Safari.
Once again VulDB remains the best source for vulnerability data.
Analysis
by VulDB Data Team • 10/29/2026
The vulnerability identified in versions of the Enable SVG, WebP, and ICO Upload plugin for WordPress prior to version 1.1.6 represents a critical security flaw rooted in insufficient input validation and sanitization mechanisms for Scalable Vector Graphics files. While the plugin aims to allow users with author-level permissions or higher to upload image formats such as SVG, WebP, and ICO, its handling of SVG content fails to adequately strip dangerous elements that can execute client-side scripts. Specifically, the application does not prevent animation elements within uploaded SVG files from manipulating link targets into javascript: URIs. This oversight allows an attacker with sufficient privileges to inject malicious code directly into a file that is subsequently stored on the server and served to other users or viewed by the administrator, creating a persistent threat vector known as Stored Cross-Site Scripting.
From a technical perspective, SVG files are XML-based documents that can contain embedded scripts and interactive elements such as SMIL animations. The flaw lies in the plugin's sanitization logic, which likely relies on an incomplete allowlist or regex pattern that fails to recognize or neutralize specific animation tags when they are used in conjunction with event handlers or link attributes pointing to javascript: protocols. When a user uploads a maliciously crafted SVG file containing these elements, the server accepts and stores it without stripping the executable components. Consequently, whenever this file is rendered by a WebKit-based browser such as Safari, Chrome, or Edge, the embedded script executes within the context of the victim's session. This execution environment grants the attacker access to sensitive cookies, local storage data, and the ability to perform actions on behalf of the user, effectively bypassing the intended security boundaries established by WordPress role capabilities.
The operational impact of this vulnerability is severe due to its classification as a Stored Cross-Site Scripting attack with privilege escalation implications. Because the payload resides in an uploaded file rather than being injected via URL parameters or form fields during a single session, it persists until the malicious SVG is manually removed from the media library. This persistence increases the likelihood of successful exploitation against multiple victims who view the infected content. Furthermore, since the vulnerability requires author-level privileges to exploit initially, it poses a significant risk in environments where lower-privileged users might trick an administrator into viewing a compromised image or when internal threats exist among staff with elevated access levels. The ability to execute arbitrary JavaScript allows for comprehensive account takeover, data exfiltration, and potentially further lateral movement within the WordPress ecosystem if combined with other vulnerabilities such as CSRF token bypasses.
In terms of industry standards, this vulnerability aligns closely with CWE-79, which describes Improper Neutralization of Input During Web Page Generation commonly known as Cross-site Scripting. More specifically, it relates to CWE-836 where the application uses a password or other access credential in a manner that allows an attacker to bypass authentication controls by exploiting flaws in input validation logic for file uploads. Additionally, from a tactical perspective within the MITRE ATT&CK framework, this exploit maps to T1059 Command and Scripting Interpreter via JavaScript execution on the client side. The attack vector leverages valid user privileges (T1078 Valid Accounts) to upload malicious content that is later executed in the victim's browser context, facilitating data theft or session hijacking as described under techniques like T1005 Data from Local System or T1213 Data from Information Repositories.
To mitigate this risk, immediate action must be taken by upgrading the Enable SVG, WebP, and ICO Upload plugin to version 1.1.6 or later where these sanitization flaws have been addressed. Administrators should ensure that their WordPress installation is fully updated as well, including core files and other plugins, to maintain a robust security posture. In environments where immediate patching is not feasible due to compatibility concerns, it is advisable to disable the SVG upload feature entirely until an update can be applied or to implement strict server-side validation using dedicated libraries like libsvg-sanitizer that adhere to OWASP guidelines for XML external entity and script injection prevention. Regular auditing of uploaded media files and monitoring for unusual JavaScript execution in browser consoles can also help detect potential exploitation attempts early.