CVE-2026-110505
Received Received - Intake

Stored XSS via SVG Upload in Enable SVG, WebP, and ICO Upload WordPress Plugin

Publication date: 2026-10-29

Last updated on: 2026-10-29

Assigner: WPScan

Description
The Enable SVG, WebP, and ICO Upload WordPress plugin before 1.1.6 does not prevent animation elements in uploaded SVG files from changing a link's target to a javascript: URI, which could allow users with the author role and above to bypass its SVG sanitization and perform Stored Cross-Site Scripting attacks that execute in WebKit-based browsers such as Safari.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-10-29
Last Modified
2026-10-29
Generated
2026-10-29
AI Q&A
2026-10-29
EPSS Evaluated
N/A
NVD
CVE-2026-110505
EUVD
EUVD-2026-112623

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
Unknown Enable SVG, WebP, and ICO Upload 0

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-UNKNOWN

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability is a Stored Cross-Site Scripting (XSS) flaw in the Enable SVG, WebP, and ICO Upload WordPress plugin before version 1.1.6. It allows users with author role or higher to upload malicious SVG files containing SMIL animation elements that change a link's target to a javascript: URI. The plugin fails to block this, enabling stored XSS attacks in WebKit-based browsers like Safari.

Detection Guidance

Check the installed version of the 'Enable SVG, WebP, and ICO Upload' plugin. If it is below 1.1.6, the system is vulnerable. Use commands like 'wp plugin list' in WordPress or inspect plugin files directly.

Impact Analysis

An attacker with author privileges or higher could upload a malicious SVG file to your WordPress site. When viewed in a WebKit browser, this could execute arbitrary JavaScript in other users' browsers, potentially stealing session cookies, redirecting to phishing pages, or performing actions on their behalf.

Compliance Impact

This vulnerability could lead to unauthorized access to user data, violating GDPR's data protection requirements and HIPAA's security rules for protected health information. A successful exploit may result in data breaches, triggering compliance violations and potential fines.

Mitigation Strategies

Update the 'Enable SVG, WebP, and ICO Upload' plugin to version 1.1.6 or later immediately. Disable SVG uploads temporarily if an update is not possible, as the vulnerability stems from improper handling of SVG files.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-110505. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart