Enable SVG, WebP, and ICO Upload

Enable SVG, WebP, and ICO Upload has 5 disclosed vulnerabilities in the WordSec catalog, reported between 2022 and 2025; all 5 are fixed as of September 2026. Their average CVSS score is 6.3, and the most serious one scores 8.8 out of 10. Severity breakdown: 0 critical and 2 high. 2025 was the busiest year with 2 disclosures.

The most common weakness is Cross-Site Scripting, behind 3 of the records (60%). Other recurring categories include Unrestricted Upload Of File With Dangerous Type.

Every one of the 5 issues recorded for Enable SVG, WebP, and ICO Upload has a vendor fix available, so running the current release closes all known holes.

4 independent researchers contributed these findings, most of them (2) reported by Kim Jong Min. Enable SVG, WebP, and ICO Upload is installed on roughly 10,000 WordPress sites, so each unpatched flaw has a wide blast radius. The current release is tested up to WordPress 7.1.

Strategic Overview

Avg CVSSMedium

6.3/ 10

Patch Coverage100%

Open

Fixed

Get automatic notifications for all Enable SVG, WebP, and ICO Upload vulnerabilities before they are exploited.

Highest severity on recordCVSS 8.8CVE-2025-13069

Enable SVG, WebP, and ICO Upload <= 1.1.3 - Authenticated (Author+) Arbitrary File Upload via ICO Upload Bypass

Read the full analysis

Vulnerability Records

5 records


2025-11-17 20:54	Enable SVG, WebP, and ICO Upload <= 1.1.3 - Authenticated (Author+) Arbitrary File Upload via ICO Upload Bypass Enable SVG, WebP, and ICO Upload <= 1.1.3	`CVE-2025-13069`	8.8 High	mikemyers	Yes
2025-11-17 20:54	Enable SVG, WebP, and ICO Upload <= 1.1.2 - Authenticated (Author+) Stored Cross-Site Scripting via SVG File Uploads Enable SVG, WebP, and ICO Upload <= 1.1.2	`CVE-2025-12457`	6.4 Medium	Sornram9254	Yes
2023-06-23 00:00	Enable SVG, WebP & ICO Upload <= 1.1.1 - Authenticated (Author+) Stored Cross-Site Scripting via SVG Enable SVG, WebP, and ICO Upload <= 1.1.1	`CVE-2023-2143`	5.4 Medium	Mateus Machado Tesser (F0x)	Yes
2022-08-01 00:00	Enable SVG, WebP & ICO Upload <= 1.0.2 - Authenticated (Author+) Stored Cross-Site Scripting Enable SVG, WebP, and ICO Upload <= 1.0.2	`CVE-2022-36343`	3.8 Low	Kim Jong Min	Yes
2022-08-01 00:00	Enable SVG, WebP & ICO Upload <= 1.1.0 - Arbitrary File Upload Enable SVG, WebP, and ICO Upload <= 1.1.0	`CVE-2022-34154`	7.2 High	Kim Jong Min	Yes

Showing 1–5 of 5 reports

Latestv1.1.5

Enable SVG, WebP, and ICO Upload

Author

ideasToCode

4.6(11)

92/100

Last Updated

2026-09-01 (11d ago)

Active Installs

10,000+

Downloads

91,930

Requires WP

4.7+

Requires PHP

7.0+

Tested up to

WP 7.1

Created

2021-04-07 (6y ago)

By default, WordPress does not allow uploading file formats like SVG, WebP, and ICO (in some hostings) citing security reasons. These files are becoming very popular and in fact, are recommended by popular web speed scan platforms like Google PageSpeed Insights or Gtmetrix to resolve the serve images in nextgen formats. Thus, this FREE PLUGIN will enable you to upload these files. Simply install the plugin and your WordPress website now can easily accept media in SVG, WebP, and ICO format. You will also have an option to disable some or all images format (of the three) as required. Tutorial video If you want to learn more about the plugin – please check our website – ideastocode.com.

View on WordPress.org