MEDIUM 6.8 NVD

CVE-2026-110504

The Enable SVG, WebP, and ICO Upload WordPress plugin before 1.1.6 does not sanitize uploaded SVG files whose content is not detected as SVG, while still storin

The Enable SVG, WebP, and ICO Upload WordPress plugin before 1.1.6 does not sanitize uploaded SVG files whose content is not detected as SVG, while still storing and serving them as SVG images, which could allow users with the author role and above to perform Stored Cross-Site Scripting attacks.

References

https://wpscan.com/vulnerability/d13d96d9-2ce7-4f83-9738-eb430f9dfb32/

Published: 2026-10-29 · Source: NVD · Feed updated: 2026-10-29

This medium severity vulnerability with a CVSS score of 6.8 was published on 2026-10-29 via NVD.

vulnfeed aggregates 16756 vulnerabilities from NVD, CISA KEV, Ubuntu, Debian, Red Hat, Kubernetes, Exploit-DB, OSS-Security, GitHub and OpenStack — updated every 4 hours.