WordPress Plugin Vulnerabilities

Enable SVG, WebP, and ICO Upload 1.1.3 - 1.1.5 - Author+ Stored XSS via SVG Sanitization Bypass

Description

The plugin does not sanitize uploaded SVG files whose content is not detected as SVG, while still storing and serving them as SVG images, which could allow users with the author role and above to perform Stored Cross-Site Scripting attacks.

Proof of Concept

Affects Plugins

Plugin icon
enable-svg-webp-ico-upload
Fixed in 1.1.6

References

CVE
CVE-2026-110504
URL
https://nvd.nist.gov/vuln/detail/CVE-2025-12457

Classification

Type
XSS
OWASP top 10
A7: Cross-Site Scripting (XSS)
CWE
CWE-79
CVSS
6.8 (medium)

Miscellaneous

Original Researcher
Shyu Yang
Submitter
Shyu Yang
Verified
Yes
WPVDB ID
d13d96d9-2ce7-4f83-9738-eb430f9dfb32

Timeline

Publicly Published
2026-10-27 (about 2 days ago)
Added
2026-10-27 (about 1 day ago)
Last Updated
2026-10-27 (about 1 day ago)

Other

Published
Title
Published
2014-08-01
Title
All in One Adsense YPN 2.0.1 - all-in-one-adsense-&-ypn.php Direct Request AdSense Account Manipulation
Published
2024-11-04
Title
UW Freelancer <= 0.1 - Reflected Cross-Site Scripting
Published
2024-03-06
Title
Booster for WooCommerce < 7.1.8 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortocde
Published
2024-11-26
Title
Panorama – WordPress Project Management Plugin <= 1.5.1 - Admin+ Stored XSS
Published
2025-02-11
Title
Rise Blocks – A Complete Gutenberg Page Builder < 3.7 - Authenticated (Contributor+) Stored Cross-Site Scripting via TitleTag Parameter