EUVD-2026-52170
GHSA-2v5f-qf73-676h
Severity by source
AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Exploitation requires at minimum Author-level authenticated access with granted SVG upload permission, warranting PR:L rather than the NVD-assigned PR:N; all other metrics align with stored XSS delivering cross-origin impact.
Primary rating from Vendor (WPScan).
CVSS VectorVendor: WPScan
Lifecycle Timeline
4DescriptionCVE.org
The SVG Support WordPress plugin before 2.5.17 does not apply its SVG sanitisation to uploaded files using the .svgz extension, even though it registers and serves them as SVG, allowing a user permitted to upload SVGs (such as an Author once granted upload access) to store a script-bearing file that executes in the browser of anyone who later views it, including an administrator.
AnalysisAI
Stored XSS in the SVG Support WordPress plugin (before 2.5.17) is achieved by uploading a script-bearing .svgz file, bypassing the plugin's sanitization logic that applies only to .svg uploads despite both extensions being registered and served as SVG content. Any WordPress user role granted SVG upload access - such as an Author - can plant the payload, which then executes in the browser of any subsequent visitor, including administrators, enabling session hijacking or privileged action injection. A public proof-of-concept exists via WPScan; EPSS is low (0.16%, 6th percentile) and SSVC rates exploitation as non-automatable, but the stored nature of the payload and admin-reachability elevate practical impact.
Technical ContextAI
SVG Support is a WordPress plugin (CPE: cpe:2.3:a:unknown:svg_support:*:*:*:*:*:*:*:*) that allows WordPress media uploads to include Scalable Vector Graphics files. Because SVG is an XML-based format capable of embedding JavaScript, the plugin implements a sanitization routine for uploaded .svg files. However, the code path responsible for sanitization is keyed to the .svg extension and is not applied to .svgz (gzip-compressed SVG), even though the plugin registers .svgz files under the same SVG MIME type and serves them identically in the browser. The browser decompresses and renders the .svgz as a full SVG document, executing any embedded script. The root cause is CWE-79 (Improper Neutralization of Input During Web Page Generation - Stored XSS): user-controlled file content reaches a browser rendering context without neutralization, due to an incomplete extension-based sanitization gate. The scope change (S:C in the CVSS vector) reflects that the payload executes within the WordPress site's origin, enabling cross-origin cookie access and action forgery against other authenticated sessions.
RemediationAI
Update SVG Support to version 2.5.17 or later, which extends the existing SVG sanitization routine to cover .svgz uploads in addition to .svg files; this is the vendor-confirmed patch per the WPScan advisory at https://wpscan.com/vulnerability/819ae1bd-3552-4e2f-a95a-0069852d745f/. If immediate patching is not possible, revoke SVG upload permissions from all non-administrator roles via the plugin's settings - this eliminates the attack surface entirely but prevents Authors and Editors from uploading SVG/SVGZ content until the patch is applied. A server-level alternative is to add a rule in .htaccess (Apache) or a location block (nginx) that blocks POST requests uploading .svgz files to the WordPress uploads directory, though this may silently break workflows for any role currently relying on .svgz uploads. Do not rely solely on toggling the plugin's SVG upload restriction, as that control's scope may not extend to .svgz files prior to 2.5.17.
More in Svg Support
View allThe SVG Support plugin for WordPress is vulnerable to Stored Cross-Site Scripting via SVG File uploads in all versions u
The SVG Support WordPress plugin before 2.5 does not properly handle SVG added via an URL, which could allow users with
The SVG Support plugin for WordPress defaults to insecure settings in version 2.5 and 2.5.1. Rated medium severity (CVSS
Same weakness CWE-79 – Cross-site Scripting (XSS)
View allShare
External POC / Exploit Code
Leaving vuln.today