CVE-2026-13340: SVG Support < 2.5.17 - Author+ Stored XSS via .svgz Sanitization Bypass
The SVG Support WordPress plugin before 2.5.17 does not apply its SVG sanitisation to uploaded files using the .svgz extension, even though it registers and serves them as SVG, allowing a user permitted to upload SVGs (such as an Author once granted upload access) to store a script-bearing file that executes in the browser of anyone who later views it, including an administrator.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2026-13340?
CVE-2026-13340 has a risk rating of 45, indicating a moderate level of severity.
How do I fix CVE-2026-13340?
To fix CVE-2026-13340, update the SVG Support WordPress plugin to version 2.5.17 or later.
What type of vulnerability is CVE-2026-13340?
CVE-2026-13340 is a stored XSS vulnerability due to a sanitization bypass in .svgz files.
Who is affected by CVE-2026-13340?
Users with the WordPress SVG Support plugin prior to version 2.5.17 who have permission to upload SVG files are affected by CVE-2026-13340.
What can an attacker do with CVE-2026-13340?
An attacker can exploit CVE-2026-13340 to upload malicious SVG files that execute scripts when accessed by a user.