CVE-2026-110505: Enable SVG, WebP, and ICO Upload < 1.1.6 - Author+ Stored XSS via SMIL Animation Bypass
The Enable SVG, WebP, and ICO Upload WordPress plugin before 1.1.6 does not prevent animation elements in uploaded SVG files from changing a link's target to a javascript: URI, which could allow users with the author role and above to bypass its SVG sanitization and perform Stored Cross-Site Scripting attacks that execute in WebKit-based browsers such as Safari.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Enable SVG, WebP, and ICO Uploadto a version that resolves this vulnerability.Fixed in 1.1.6
Event History
Frequently Asked Questions
Who can exploit this issue?
A user with the WordPress author role or a higher-privileged role can exploit it by uploading a crafted SVG file. The resulting stored script execution affects visitors using WebKit-based browsers, such as Safari.
What is required for the payload to execute?
The attacker needs to upload an SVG containing SMIL animation elements that change a link target to a javascript: URI. Execution is described as occurring in WebKit-based browsers.
Which plugin versions are affected?
Versions of Enable SVG, WebP, and ICO Upload before 1.1.6 are affected. Updating to 1.1.6 or later addresses the affected version range.