---
id: CVE-2026-110504
title: >-
  Enable SVG, WebP, and ICO Upload 1.1.3 - 1.1.5 - Author+ Stored XSS via SVG
  Sanitization Bypass
summary: >-
  The Enable SVG, WebP, and ICO Upload WordPress plugin before 1.1.6 does not
  sanitize uploaded SVG files whose content is not detected as SVG, while still
  storing and serving them as SVG images, which could allow users with the
  author rol…
severity: medium
cvss: 6.8
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:H/I:H/A:H'
cvssSource: adp
cwe:
  - CWE-79
product: 'Enable SVG, WebP, and ICO Upload'
affected:
  - enable_svg_webp_and_ico_upload >= 1.1.3 < 1.1.6
ssvc:
  exploitation: none
  automatable: 'no'
  technicalImpact: total
  timestamp: '2026-10-29T10:50:33.201986Z'
published: '2026-10-29'
updated: '2026-10-29'
sourceUpdated: '2026-10-29T10:56:07.031Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2026-110504'
references:
  - url: 'https://wpscan.com/vulnerability/d13d96d9-2ce7-4f83-9738-eb430f9dfb32/'
tags:
  - cve.org
epss: 0.0029
epssPercentile: 0.21694
ingestedAt: '2026-11-01T17:57:46.218Z'
---

## Overview

The Enable SVG, WebP, and ICO Upload WordPress plugin before 1.1.6 does not sanitize uploaded SVG files whose content is not detected as SVG, while still storing and serving them as SVG images, which could allow users with the author role and above to perform Stored Cross-Site Scripting attacks.

## Affected

- `enable_svg_webp_and_ico_upload >= 1.1.3 < 1.1.6`

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.