Read the docs

Vulnerabilities

Filters

Reset all
Threatist priority
Signals
Fix status
Impact type
Attack vector
Product

Products as named in CPE, with their records.

Published
Weakness (CWE)
1 selected

2 records

Release: Enable SVG, WebP, and ICO Upload 1.1.6 Clear all filters
TI-2026-82298 CVE-2026-110505 · GHSA-cghp-w6p2-hcf7

Stored XSS in Enable SVG, WebP, and ICO Upload via SMIL animation

Priority LOW 32

The Enable SVG, WebP, and ICO Upload WordPress plugin before 1.1.6 does not prevent animation elements in uploaded SVG files from changing a link's target to a javascript: URI, which could allow users with the author rol…

CVSS 3.1MEDIUM 6.8 Network High privileges User interaction EPSS 0.00391 Published 2026-10-29 Fixed in 1.1.6 CWE-79
TI-2026-82297 CVE-2026-110504 · GHSA-898g-xh4c-5hhj

Stored XSS in Enable SVG, WebP, and ICO Upload via SVG sanitization bypass

Priority LOW 32

The Enable SVG, WebP, and ICO Upload WordPress plugin before 1.1.6 does not sanitize uploaded SVG files whose content is not detected as SVG, while still storing and serving them as SVG images, which could allow users wi…

CVSS 3.1MEDIUM 6.8 Network High privileges User interaction EPSS 0.0029 Published 2026-10-29 Fixed in 1.1.6 CWE-79