Vulnerabilities

TI-2025-11432 CVE-2025-12457 · GHSA-6ggq-8v59-pgc4

Enable SVG, WebP, and ICO Upload <= 1.1.2 - Authenticated (Author+) Stored Cross-Site Scripting via SVG File Uploads

LOW 28

The Enable SVG, WebP, and ICO Upload plugin for WordPress is vulnerable to Stored Cross-Site Scripting via SVG File uploads in all versions up to, and including, 1.1.2 due to insufficient input sanitization and output es…

CVSS 3.1MEDIUM 6.4 Network Low privileges No interaction EPSS 0.00238 Published 2025-11-18 No fix listed CWE-79

TI-2025-11954 CVE-2025-13069 · GHSA-4x87-f7m7-6w77

Enable SVG, WebP, and ICO Upload <= 1.1.3 - Authenticated (Author+) Arbitrary File Upload via ICO Upload Bypass

MEDIUM 41

The Enable SVG, WebP, and ICO Upload plugin for WordPress is vulnerable to arbitrary file upload in all versions up to, and including, 1.1.3.

CVSS 3.1HIGH 8.8 Network Low privileges No interaction EPSS 0.00689 Published 2025-11-18 No fix listed CWE-434

TI-2023-02011 CVE-2023-2143 · GHSA-qx59-vmgp-6rg3

Enable SVG, WebP & ICO Upload <= 1.0.3 - Author+ Stored XSS

MEDIUM 58

The Enable SVG, WebP & ICO Upload WordPress plugin through 1.0.3 does not sanitize SVG file contents, leading to a Cross-Site Scripting vulnerability.

CVSS 3.1MEDIUM 5.4 Network Low privileges User interaction EPSS 0.00323 Published 2023-07-17 No fix listed

TI-2022-15070 CVE-2022-34154 · GHSA-9r23-xjjv-gr5j

WordPress Enable SVG, WebP & ICO Upload plugin <= 1.0.1 - Authenticated Arbitrary File Upload vulnerability

MEDIUM 43

Authenticated (author or higher user role) Arbitrary File Upload vulnerability in ideasToCode Enable SVG, WebP & ICO Upload plugin <= 1.0.1 at WordPress.

CVSS 3.1HIGH 8.8 Network Low privileges No interaction EPSS 0.01282 Published 2022-08-01 No fix listed CWE-434

TI-2022-16685 CVE-2022-36343 · GHSA-6qmq-v879-phcg

WordPress Enable SVG, WebP & ICO Upload plugin <= 1.0.1 - Authenticated Stored Cross-Site Scripting (XSS) vulnerability

LOW 25

Authenticated (author or higher user role) Stored Cross-Site Scripting (XSS) vulnerability in ideasToCode Enable SVG, WebP & ICO Upload plugin <= 1.0.1 at WordPress.

CVSS 3.1MEDIUM 5.4 Network Low privileges User interaction EPSS 0.00572 Published 2022-08-01 No fix listed CWE-79