WP SVG Images
WP SVG Images has 2 disclosed vulnerabilities in the WordSec catalog, reported between 2021 and 2024; all 2 are fixed as of September 2026. Their average CVSS score is 6.4, and the most serious one scores 6.4 out of 10.
The most common weakness is Cross-Site Scripting, behind 2 of the records (100%).
Every one of the 2 issues recorded for WP SVG Images has a vendor fix available, so running the current release closes all known holes.
2 independent researchers contributed these findings, one record each. WP SVG Images is installed on roughly 30,000 WordPress sites, so each unpatched flaw has a wide blast radius. The current release is tested up to WordPress 7.1.
CVE-2024-5945WP SVG Images <= 4.3 - Authenticated (Author+) Stored Cross-Site Scripting via SVG
Read the full analysisVulnerability Records

WP SVG Images
Author
ShortPixel
Securely upload SVG files to your Media Library. Uploaded SVG files are automatically sanitized. SVG stands for Scalable Vector Graphics and is probably the most efficient way to display images. WP SVG Images Plugin is an easy-to-use and lightweight plugin that allows you to upload SVG files to your media library safely and easily. Features Support for SVG uploads to your Media Library. Sanitize uploaded SVG files. Malicious SVG/XML files are rejected from upload. Admin configurable SVG support for different user roles. Ability to disable SVG upload for different user roles. Different user roles can upload and/or sanitize the uploaded SVG images. SVG preview in Media Library. Support 24/7 SVG support offered by ShortPixel here or here. Recommended plugins This plugin is supported & maintained by ShortPixel. Other popular plugins by ShortPixel: FastPixel Caching – WP Optimization made easy ShortPixel Image Optimizer – Image optimization & compression for all the images on your website, including WebP delivery – ShortPixel Image Optimizer. ShortPixel Adaptive Images – On-the-fly image optimization & CDN delivery. Enable Media Replace – Easily replace images or files in Media Library. reGenerate Thumbnails Advanced – Easily regenerate thumbnails. Resize Image After Upload – Automatically resize each uploaded image. Hooks for developers WPSVG_setAllowedTags Allows you to specify more tags that will be not removed during sanitization add_filter( 'WPSVG_setAllowedTags', 'my_custom_allowed_svg_tags', 10, 1 ); function my_custom_allowed_svg_tags( $tags ){ $tags[] = 'path'; return $tags; } WPSVG_setAllowedAttrs Allows you to specify more attributes that will be not removed during sanitization add_filter( 'WPSVG_setAllowedAttrs', 'my_custom_allowed_svg_attributes', 10, 1 ); function my_custom_allowed_svg_attributes( $attributes ){ $attributes[] = 'fill'; return $attributes; }
Vulnerability data © Defiant, Inc., provided under the Wordfence Intelligence T&C