WordPress security by component

SVG Support

Plugin description

SVG Support enables SVG uploads and provides tools for displaying scalable vector graphics in WordPress.

SVG Support (svg-support) is a WordPress plugin with 7 published CVE records in this archive. The latest tracked vulnerability was published Aug 03, 2026; the highest published CVSS base score is 6.4.

Plugin slug: svg-support

Latest vulnerability

CVE-2026-13340: SVG Support skips sanitization for compressed SVG uploads

SVG Support before 2.5.17 registers and serves .svgz files as SVG but does not pass them through its SVG sanitizer. A user permitted to upload SVG files, such as an Author after SVG upload access is granted, can upload a compressed script-bearing SVG that executes in the browser of visitors or Administrators who view it.

PublishedAug 03, 2026

Known safe version2.5.17

Published vulnerabilities for svg-support
		Safe version
Aug 03, 2026	CVE-2026-13340 SVG Support skips sanitization for compressed SVG uploads SVG Support before 2.5.17 registers and serves .svgz files as SVG but does not pass them through its SVG sanitizer. A user permitted to upload SVG files, such as an Author after SVG upload access is granted, can upload a compressed script-bearing SVG that executes in the browser of visitors or Administrators who view it.	2.5.17	CVE6.1 NVDPending
May 27, 2026	CVE-2026-48973 SVG Support: A security weakness SVG Support is affected by a security weakness. Exposure depends on how the affected operation is made reachable by the site. The resulting impact depends on how the affected component exposes the vulnerable operation. The published affected range is n/a through 2.5.14.	2.5.15	CVE4.3 NVDPending
Feb 21, 2025	CVE-2024-10222 SVG Support: Cross-site scripting SVG Support is affected by cross-site scripting. Exploitation requires an authenticated author account. Injected script can execute in the affected site's origin when the vulnerable output is viewed.	See mitigation notes	CVE6.4 NVD5.4
Jul 18, 2024	CVE-2023-6708 SVG Support: Cross-site scripting SVG Support is affected by cross-site scripting. Exploitation requires an authenticated author account. Injected script can execute in the affected site's origin when the vulnerable output is viewed.	See mitigation notes	CVE5.4 NVDPending
Nov 16, 2022	CVE-2022-4022 SVG Support: A security weakness SVG Support is affected by a security weakness. Exploitation requires an authenticated author account. The resulting impact depends on how the affected component exposes the vulnerable operation.	See mitigation notes	CVE6.4 NVD5.4
Sep 26, 2022	CVE-2022-1755 SVG Support: Cross-site scripting SVG Support is affected by cross-site scripting. Exposure depends on how the affected operation is made reachable by the site. Injected script can execute in the affected site's origin when the vulnerable output is viewed.	See mitigation notes	CVE5.4 NVD5.4
Feb 01, 2022	CVE-2021-24686 SVG Support: Cross-site scripting SVG Support is affected by cross-site scripting. Exposure depends on how the affected operation is made reachable by the site. Injected script can execute in the affected site's origin when the vulnerable output is viewed.	See mitigation notes	CVEPending NVD4.8

Data attribution: This product uses the NVD API but is not endorsed or certified by the NVD.

Vulnerability data licensing

CVE. Copyright © 1999–2026, The MITRE Corporation. MITRE hereby grants you a perpetual, worldwide, non-exclusive, no-charge, royalty-free, irrevocable copyright license to reproduce, prepare derivative works of, publicly display, publicly perform, sublicense, and distribute Common Vulnerabilities and Exposures (CVE™). Any copy you make for such purposes is authorized provided that you reproduce MITRE's copyright designation and this license in any such copy.

CWE. Copyright © 2006–2026, The MITRE Corporation. CWE™ is free to use by any organization or individual for any research, development, and/or commercial purposes, per these CWE Terms of Use. Accordingly, The MITRE Corporation hereby grants you a non-exclusive, royalty-free license to use CWE for research, development, and commercial purposes. Any copy you make for such purposes is authorized on the condition that you reproduce MITRE’s copyright designation and this license in any such copy.

CVSS. CVSS is owned and managed by FIRST.Org, Inc. (FIRST) and used by permission.

Source-record text is CVE/CNA content delivered through the NVD API. Fused summaries and remediation guidance are independently authored and are not attributed to NVD.

All other copyrights and trademarks are the property of their respective owners.

Full data sources, terms, and disclaimers