CVE-2026-13340
Received Received - Intake

SVGZ File XSS in SVG Support WordPress Plugin

Publication date: 2026-08-03

Last updated on: 2026-08-03

Assigner: WPScan

Description
The SVG Support WordPress plugin before 2.5.17 does not apply its SVG sanitisation to uploaded files using the .svgz extension, even though it registers and serves them as SVG, allowing a user permitted to upload SVGs (such as an Author once granted upload access) to store a script-bearing file that executes in the browser of anyone who later views it, including an administrator.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-08-03
Last Modified
2026-08-03
Generated
2026-08-03
AI Q&A
2026-08-03
EPSS Evaluated
N/A
NVD
CVE-2026-13340
EUVD
EUVD-2026-52170

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
svg_support svg_support to 2.5.17 (exc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-UNKNOWN

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

The SVG Support WordPress plugin before version 2.5.17 fails to sanitize SVG files with the .svgz extension during upload. This allows users with upload permissions, such as Authors, to store malicious scripts in SVGZ files. When these files are viewed by others, including administrators, the scripts execute in their browsers.

Detection Guidance

Check for uploaded .svgz files in your WordPress uploads directory, particularly those with executable scripts. Review user roles with upload permissions and inspect files served as SVG content.

Impact Analysis

If you use the SVG Support plugin before 2.5.17, an attacker with upload access could upload a malicious SVGZ file. When viewed, this file could execute arbitrary scripts in your browser, potentially leading to account takeover, data theft, or further compromise of your WordPress site.

Compliance Impact

This vulnerability could lead to unauthorized access to sensitive data, violating GDPR's data protection requirements and HIPAA's security rules. If exploited, it may result in data breaches, triggering compliance violations and potential legal penalties.

Mitigation Strategies

Update the SVG Support plugin to version 2.5.17 or later. Remove any existing .svgz files with suspicious content and restrict upload permissions to trusted users only.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-13340. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart