Medium severity · published Oct 29, 2026
CVE-2026-110504
Enable SVG, WebP, and ICO Upload 1.1.3 - 1.1.5 - Author+ Stored XSS via SVG Sanitization Bypass
New
6.8
CVSS
–
EPSS
No
On KEV
Description
The Enable SVG, WebP, and ICO Upload WordPress plugin before 1.1.6 does not sanitize uploaded SVG files whose content is not detected as SVG, while still storing and serving them as SVG images, which could allow users with the author role and above to perform Stored Cross-Site Scripting attacks.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:H/I:H/A:H
Attack vector
Network
Complexity
Low
Privileges
High
User interaction
Required
Confidentiality
High
Integrity
High
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
ES
Enable SVG, WebP, and ICO Upload ·
1.1.3 before 1.1.6 · source: vendor
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2026-110504
CVE.org
https://www.cve.org/CVERecord?id=CVE-2026-110504
exploit
https://wpscan.com/vulnerability/d13d96d9-2ce7-4f83-9738-eb430f9dfb32/
More from Enable SVG, WebP, and ICO Upload
6.8
CVE-2026-110505
Enable SVG, WebP, and ICO Upload < 1.1.6 - Author+ Stored XSS via SMIL Animation Bypass