10up/safe-svg

10up/safe-svg

GitHubGitHub
GitHubgithub.com
WordPress Pluginwordpress.org
Releases31
Frequency2 months 4 weeks
Last Release
Stars335
Enable SVG uploads and sanitize them to stop XML/SVG vulnerabilities in your WordPress website.
Log in to subscribe

CVE History

CVEPublishedCVSS v3CVSS v2
CVE-2022-1091↗
6.1 MEDIUM4.3 MEDIUM

The sanitisation step of the Safe SVG WordPress plugin before 1.9.10 can be bypassed by spoofing the content-type in the POST request to upload a file. Exploiting this vulnerability, an attacker will be able to perform the kinds of attacks that this plugin should prevent (mainly XSS, but depending on further use of uploaded SVG files potentially other XML attacks).