All vulnerabilities
CVE-2026-110504

Enable SVG, WebP, and ICO Upload 1.1.3 - 1.1.5 - Author+ Stored XSS via SVG Sanitization Bypass

Unknown Enable SVG, WebP, and ICO Upload
Open in ThreatlineRecord JSON
CVSS
NoneNot scored
ExploitationNo known exploitationNot in CISA KEV, which does not prove it is unexploitedCISA KEV
Exploit odds (EPSS)No scoreNo FIRST EPSS score in this snapshot yet
Fixed in1.1.6Fixed versionCVE List
Published29 Oct 2026Updated 29 Oct 2026CVE List

What fixes it

  • 1.1.6Enable SVG, WebP, and ICO UploadCVE List

A fixed version on one release line is not the upgrade target for every line. Check your exact version and any vendor backports.

Description

The Enable SVG, WebP, and ICO Upload WordPress plugin before 1.1.6 does not sanitize uploaded SVG files whose content is not detected as SVG, while still storing and serving them as SVG images, which could allow users with the author role and above to perform Stored Cross-Site Scripting attacks.

Text from CVE List

Affected versions 1

  • Enable SVG, WebP, and ICO Uploadaffected: 1.1.3 before 1.1.6CVE List

References 1