WordPress security by component
Enable SVG, WebP, and ICO Upload
Plugin description
Enable SVG, WebP, and ICO Upload is a WordPress component with 5 published CVE records in this archive. The latest tracked vulnerability was published Nov 18, 2025; the highest CVE/CNA score is 8.8.
Plugin slug:
enable-svg-webp-ico-uploadLatest vulnerability
CVE-2025-13069: Enable SVG, WebP, and ICO Upload: Dangerous file upload
Enable SVG, WebP, and ICO Upload is affected by dangerous file upload. Exploitation requires at least author-level access. Successful exploitation can place attacker-controlled executable content on the server and may lead to full site compromise.
Known source slugs: enable-svg,-webp-&-ico-upload, enable-svg-webp-ico-upload
| Safe version |
|
||
|---|---|---|---|
| Nov 18, 2025 |
CVE-2025-13069
Enable SVG, WebP, and ICO Upload: Dangerous file upload
Enable SVG, WebP, and ICO Upload is affected by dangerous file upload. Exploitation requires at least author-level access. Successful exploitation can place attacker-controlled executable content on the server and may lead to full site compromise.
|
See mitigation notes |
CVE8.8
NVDPending
|
| Nov 18, 2025 |
CVE-2025-12457
Enable SVG, WebP, and ICO Upload: Cross-site scripting
Enable SVG, WebP, and ICO Upload is affected by cross-site scripting. Exploitation requires at least author-level access. Injected script can execute in the affected site's origin when the vulnerable output is viewed.
|
See mitigation notes |
CVE6.4
NVDPending
|
| Jul 17, 2023 |
CVE-2023-2143
Enable SVG, WebP & ICO Upload: Cross-site scripting
Enable SVG, WebP & ICO Upload is affected by cross-site scripting. Exposure depends on how the affected operation is made reachable by the site. Injected script can execute in the affected site's origin when the vulnerable output is viewed.
|
See mitigation notes |
CVE5.4
NVD5.4
|
| Aug 01, 2022 |
CVE-2022-36343
Enable Svg Webp Ico Upload: Cross-site scripting
Enable Svg Webp Ico Upload is affected by cross-site scripting. Exposure depends on how the affected operation is made reachable by the site. Injected script can execute in the affected site's origin when the vulnerable output is viewed.
|
See mitigation notes |
CVE3.4
NVD5.4
|
| Aug 01, 2022 |
CVE-2022-34154
Enable Svg Webp Ico Upload: Dangerous file upload
Enable Svg Webp Ico Upload is affected by dangerous file upload. Exposure depends on how the affected operation is made reachable by the site. Successful exploitation can place attacker-controlled executable content on the server and may lead to full site compromise.
|
See mitigation notes |
CVE7.2
NVD8.8
|