Unrated severityNVD Advisory· Published Oct 29, 2026

CVE-2026-110504

Description

The Enable SVG, WebP, and ICO Upload WordPress plugin before 1.1.6 does not sanitize uploaded SVG files whose content is not detected as SVG, while still storing and serving them as SVG images, which could allow users with the author role and above to perform Stored Cross-Site Scripting attacks.

Patches

Vulnerability mechanics

References

wpscan.com/vulnerability/d13d96d9-2ce7-4f83-9738-eb430f9dfb32/nvd

News mentions

No linked articles in our index yet.

cvss	0.000
epss	0.000
exploit	0.000
kev	0.000
patch	0.000
ransomware	0.000