Search

Find a vulnerability

Search criteria

    4 vulnerabilities found for Enable SVG, WebP, and ICO Upload by Unknown

    CVE-2026-110505 (GCVE-0-2026-110505)

    Vulnerability from nvd – Published: 2026-10-29 06:00 – Updated: 2026-10-29 06:00
    VLAI
    Title
    Enable SVG, WebP, and ICO Upload < 1.1.6 - Author+ Stored XSS via SMIL Animation Bypass
    Summary
    The Enable SVG, WebP, and ICO Upload WordPress plugin before 1.1.6 does not prevent animation elements in uploaded SVG files from changing a link's target to a javascript: URI, which could allow users with the author role and above to bypass its SVG sanitization and perform Stored Cross-Site Scripting attacks that execute in WebKit-based browsers such as Safari.
    Severity
    No CVSS data available.
    CWE
    Assigner
    WPScan CNA under the mitre root
    CNA scorecard E 44/100 over 1922 records in the last 180 days details
    References
    URL Tags
    https://wpscan.com/vulnerability/5fc2b6c9-a9e6-48… exploitvdb-entrytechnical-description
    Impacted products
    Vendor Product Version
    Unknown Enable SVG, WebP, and ICO Upload Affected: 0 , < 1.1.6 (semver)
    		Create a notification for this product.
    Credits
    Pierre Rudloff WPScan
    Show details on NVD website
    To clipboard 

    {
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Enable SVG, WebP, and ICO Upload",
          "vendor": "Unknown",
          "versions": [
            {
              "lessThan": "1.1.6",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "Pierre Rudloff"
        },
        {
          "lang": "en",
          "type": "coordinator",
          "value": "WPScan"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "The Enable SVG, WebP, and ICO Upload WordPress plugin before 1.1.6 does not prevent animation elements in uploaded SVG files from changing a link\u0027s target to a javascript: URI, which could allow users with the author role and above to bypass its SVG sanitization and perform Stored Cross-Site Scripting attacks that execute in WebKit-based browsers such as Safari."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "CWE-79 Cross-Site Scripting (XSS)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-10-29T06:00:24.942Z",
        "orgId": "1bfdd5d7-9bf6-4a53-96ea-42e2716d7a81",
        "shortName": "WPScan"
      },
      "references": [
        {
          "tags": [
            "exploit",
            "vdb-entry",
            "technical-description"
          ],
          "url": "https://wpscan.com/vulnerability/5fc2b6c9-a9e6-48c2-99ec-7912da3297ae/"
        }
      ],
      "source": {
        "discovery": "EXTERNAL"
      },
      "title": "Enable SVG, WebP, and ICO Upload \u003c 1.1.6 - Author+ Stored XSS via SMIL Animation Bypass",
      "x_generator": {
        "engine": "WPScan CVE Generator"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "1bfdd5d7-9bf6-4a53-96ea-42e2716d7a81",
    "assignerShortName": "WPScan",
    "cveId": "CVE-2026-110505",
    "datePublished": "2026-10-29T06:00:24.942Z",
    "dateReserved": "2026-10-14T10:38:14.192Z",
    "dateUpdated": "2026-10-29T06:00:24.942Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

    CVE-2026-110504 (GCVE-0-2026-110504)

    Vulnerability from nvd – Published: 2026-10-29 06:00 – Updated: 2026-10-29 06:00
    VLAI
    Title
    Enable SVG, WebP, and ICO Upload 1.1.3 - 1.1.5 - Author+ Stored XSS via SVG Sanitization Bypass
    Summary
    The Enable SVG, WebP, and ICO Upload WordPress plugin before 1.1.6 does not sanitize uploaded SVG files whose content is not detected as SVG, while still storing and serving them as SVG images, which could allow users with the author role and above to perform Stored Cross-Site Scripting attacks.
    Severity
    No CVSS data available.
    CWE
    Assigner
    WPScan CNA under the mitre root
    CNA scorecard E 44/100 over 1922 records in the last 180 days details
    References
    URL Tags
    https://wpscan.com/vulnerability/d13d96d9-2ce7-4f… exploitvdb-entrytechnical-description
    Impacted products
    Vendor Product Version
    Unknown Enable SVG, WebP, and ICO Upload Affected: 1.1.3 , < 1.1.6 (semver)
    		Create a notification for this product.
    Credits
    Shyu Yang WPScan
    Show details on NVD website
    To clipboard 

    {
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Enable SVG, WebP, and ICO Upload",
          "vendor": "Unknown",
          "versions": [
            {
              "lessThan": "1.1.6",
              "status": "affected",
              "version": "1.1.3",
              "versionType": "semver"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "Shyu Yang"
        },
        {
          "lang": "en",
          "type": "coordinator",
          "value": "WPScan"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "The Enable SVG, WebP, and ICO Upload WordPress plugin before 1.1.6 does not sanitize uploaded SVG files whose content is not detected as SVG, while still storing and serving them as SVG images, which could allow users with the author role and above to perform Stored Cross-Site Scripting attacks."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "CWE-79 Cross-Site Scripting (XSS)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-10-29T06:00:24.769Z",
        "orgId": "1bfdd5d7-9bf6-4a53-96ea-42e2716d7a81",
        "shortName": "WPScan"
      },
      "references": [
        {
          "tags": [
            "exploit",
            "vdb-entry",
            "technical-description"
          ],
          "url": "https://wpscan.com/vulnerability/d13d96d9-2ce7-4f83-9738-eb430f9dfb32/"
        }
      ],
      "source": {
        "discovery": "EXTERNAL"
      },
      "title": "Enable SVG, WebP, and ICO Upload 1.1.3 - 1.1.5 - Author+ Stored XSS via SVG Sanitization Bypass",
      "x_generator": {
        "engine": "WPScan CVE Generator"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "1bfdd5d7-9bf6-4a53-96ea-42e2716d7a81",
    "assignerShortName": "WPScan",
    "cveId": "CVE-2026-110504",
    "datePublished": "2026-10-29T06:00:24.769Z",
    "dateReserved": "2026-10-14T10:38:10.534Z",
    "dateUpdated": "2026-10-29T06:00:24.769Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

    CVE-2026-110505 (GCVE-0-2026-110505)

    Vulnerability from cvelistv5 – Published: 2026-10-29 06:00 – Updated: 2026-10-29 06:00
    VLAI
    Title
    Enable SVG, WebP, and ICO Upload < 1.1.6 - Author+ Stored XSS via SMIL Animation Bypass
    Summary
    The Enable SVG, WebP, and ICO Upload WordPress plugin before 1.1.6 does not prevent animation elements in uploaded SVG files from changing a link's target to a javascript: URI, which could allow users with the author role and above to bypass its SVG sanitization and perform Stored Cross-Site Scripting attacks that execute in WebKit-based browsers such as Safari.
    Severity
    No CVSS data available.
    CWE
    Assigner
    WPScan CNA under the mitre root
    CNA scorecard E 44/100 over 1922 records in the last 180 days details
    References
    URL Tags
    https://wpscan.com/vulnerability/5fc2b6c9-a9e6-48… exploitvdb-entrytechnical-description
    Impacted products
    Vendor Product Version
    Unknown Enable SVG, WebP, and ICO Upload Affected: 0 , < 1.1.6 (semver)
    		Create a notification for this product.
    Credits
    Pierre Rudloff WPScan
    Show details on NVD website
    To clipboard 

    {
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Enable SVG, WebP, and ICO Upload",
          "vendor": "Unknown",
          "versions": [
            {
              "lessThan": "1.1.6",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "Pierre Rudloff"
        },
        {
          "lang": "en",
          "type": "coordinator",
          "value": "WPScan"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "The Enable SVG, WebP, and ICO Upload WordPress plugin before 1.1.6 does not prevent animation elements in uploaded SVG files from changing a link\u0027s target to a javascript: URI, which could allow users with the author role and above to bypass its SVG sanitization and perform Stored Cross-Site Scripting attacks that execute in WebKit-based browsers such as Safari."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "CWE-79 Cross-Site Scripting (XSS)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-10-29T06:00:24.942Z",
        "orgId": "1bfdd5d7-9bf6-4a53-96ea-42e2716d7a81",
        "shortName": "WPScan"
      },
      "references": [
        {
          "tags": [
            "exploit",
            "vdb-entry",
            "technical-description"
          ],
          "url": "https://wpscan.com/vulnerability/5fc2b6c9-a9e6-48c2-99ec-7912da3297ae/"
        }
      ],
      "source": {
        "discovery": "EXTERNAL"
      },
      "title": "Enable SVG, WebP, and ICO Upload \u003c 1.1.6 - Author+ Stored XSS via SMIL Animation Bypass",
      "x_generator": {
        "engine": "WPScan CVE Generator"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "1bfdd5d7-9bf6-4a53-96ea-42e2716d7a81",
    "assignerShortName": "WPScan",
    "cveId": "CVE-2026-110505",
    "datePublished": "2026-10-29T06:00:24.942Z",
    "dateReserved": "2026-10-14T10:38:14.192Z",
    "dateUpdated": "2026-10-29T06:00:24.942Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

    CVE-2026-110504 (GCVE-0-2026-110504)

    Vulnerability from cvelistv5 – Published: 2026-10-29 06:00 – Updated: 2026-10-29 06:00
    VLAI
    Title
    Enable SVG, WebP, and ICO Upload 1.1.3 - 1.1.5 - Author+ Stored XSS via SVG Sanitization Bypass
    Summary
    The Enable SVG, WebP, and ICO Upload WordPress plugin before 1.1.6 does not sanitize uploaded SVG files whose content is not detected as SVG, while still storing and serving them as SVG images, which could allow users with the author role and above to perform Stored Cross-Site Scripting attacks.
    Severity
    No CVSS data available.
    CWE
    Assigner
    WPScan CNA under the mitre root
    CNA scorecard E 44/100 over 1922 records in the last 180 days details
    References
    URL Tags
    https://wpscan.com/vulnerability/d13d96d9-2ce7-4f… exploitvdb-entrytechnical-description
    Impacted products
    Vendor Product Version
    Unknown Enable SVG, WebP, and ICO Upload Affected: 1.1.3 , < 1.1.6 (semver)
    		Create a notification for this product.
    Credits
    Shyu Yang WPScan
    Show details on NVD website
    To clipboard 

    {
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Enable SVG, WebP, and ICO Upload",
          "vendor": "Unknown",
          "versions": [
            {
              "lessThan": "1.1.6",
              "status": "affected",
              "version": "1.1.3",
              "versionType": "semver"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "Shyu Yang"
        },
        {
          "lang": "en",
          "type": "coordinator",
          "value": "WPScan"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "The Enable SVG, WebP, and ICO Upload WordPress plugin before 1.1.6 does not sanitize uploaded SVG files whose content is not detected as SVG, while still storing and serving them as SVG images, which could allow users with the author role and above to perform Stored Cross-Site Scripting attacks."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "CWE-79 Cross-Site Scripting (XSS)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-10-29T06:00:24.769Z",
        "orgId": "1bfdd5d7-9bf6-4a53-96ea-42e2716d7a81",
        "shortName": "WPScan"
      },
      "references": [
        {
          "tags": [
            "exploit",
            "vdb-entry",
            "technical-description"
          ],
          "url": "https://wpscan.com/vulnerability/d13d96d9-2ce7-4f83-9738-eb430f9dfb32/"
        }
      ],
      "source": {
        "discovery": "EXTERNAL"
      },
      "title": "Enable SVG, WebP, and ICO Upload 1.1.3 - 1.1.5 - Author+ Stored XSS via SVG Sanitization Bypass",
      "x_generator": {
        "engine": "WPScan CVE Generator"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "1bfdd5d7-9bf6-4a53-96ea-42e2716d7a81",
    "assignerShortName": "WPScan",
    "cveId": "CVE-2026-110504",
    "datePublished": "2026-10-29T06:00:24.769Z",
    "dateReserved": "2026-10-14T10:38:10.534Z",
    "dateUpdated": "2026-10-29T06:00:24.769Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}