Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1359 CNY

100%

Buy Us a Coffee

CVE-2026-110504— Enable SVG, WebP, and ICO Upload 1.1.3 - 1.1.5 - Author+ Stored XSS via SVG Sanitization Bypass

Quick assessment

Affected

Unknown Enable SVG, WebP, and ICO Upload

Exploitation

No confirmed in-the-wild exploitation; assess based on exposure

Recommended action

Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

在 1.1.6 版本之前的"Enable SVG, WebP, and ICO Upload"WordPress 插件中，对于内容未被识别为 SVG 的上传 SVG 文件，插件未进行清理（sanitization）处理，但仍将其作为 SVG 图像存储并对外提供。这可能导致拥有作者（author）角色及以上权限的用户实施存储型跨站脚本（Stored Cross-Site Scripting, XSS）攻击。

AI Predicted 6.1 Difficulty: Easy Updated Oct 29, 2026

Possible ATT&CK Techniques 2 AI

T1059.007 · JavaScript T1190 · Exploit Public-Facing Application

Updated Oct 29, 2026

Get alerts for future matching vulnerabilities Log in to subscribe

Vulnerability Information

Have questions about the vulnerability? See if Shenlong's analysis helps!

View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title

Enable SVG, WebP, and ICO Upload 1.1.3 - 1.1.5 - Author+ Stored XSS via SVG Sanitization Bypass

Source: CVE Program / CVE List V5

Vulnerability Description

The Enable SVG, WebP, and ICO Upload WordPress plugin before 1.1.6 does not sanitize uploaded SVG files whose content is not detected as SVG, while still storing and serving them as SVG images, which could allow users with the author role and above to perform Stored Cross-Site Scripting attacks.

Source: CVE Program / CVE List V5

CVSS Information

N/A

Source: CVE Program / CVE List V5

Vulnerability Type

N/A

Source: CVE Program / CVE List V5

Affected Products

Vendor	Product	Affected Versions	CPE	Subscribe
Unknown	Enable SVG, WebP, and ICO Upload	1.1.3 ~ 1.1.6	-

II. Public POCs for CVE-2026-110504

#	POC Description	Source Link	Shenlong Link

AI-Generated POC Premium

No public POC found.

III. Intelligence Information for CVE-2026-110504

请登录查看更多情报信息。

Other References for CVE-2026-110504 (1)

https://wpscan.com/vulnerability/d13d96d9-2ce7-4f83-9738-eb430f9dfb32/ exploit vdb-entry technical-description

https://www.cve.org/CVERecord?id=CVE-2026-110504

Same Patch Batch · Unknown · 2026-10-29 · 28 CVEs total

CVE-2026-115303	3.7 LOW	Contact Form by Supsystic < 1.11.1 - Unauthenticated CRLF / Email Header Injection via Rep
CVE-2026-103693		Frontend Dashboard < 3.0.5 and ProfileGrid < 6.0.0.5 - Unauthenticated PHP Object Injectio
CVE-2026-115282		Recipe Card Blocks Lite 2.6.4 - 3.6.3 - Unauthenticated Unpublished Post Content Disclosur
CVE-2026-115302		Contact Form by Supsystic < 1.11.1 - Unauthenticated Arbitrary Statistics Deletion
CVE-2026-115301		Contact Form by Supsystic < 1.11.1 - Admin+ SSTI via Form Text Block
CVE-2026-115299		Contact Form by Supsystic < 1.11.1 - Arbitrary Plugin Settings Update via CSRF
CVE-2026-115300		Contact Form by Supsystic < 1.11.1 - Contact Submission and Statistics Deletion via CSRF
CVE-2026-88928		PAYCOMET for WooCommerce 5.36 - 5.45 - Unauthenticated Stored Payment Token Overwrite via
CVE-2026-78395		Link Library < 7.10.0 - Unauthenticated Link Submission Login Requirement Bypass
CVE-2026-78396		Link Library < 7.10.0 - Unauthenticated Link Contact and Submitter Information Disclosure
CVE-2026-89216		vTables < 0.3 - Unauthenticated SQL Injection via orderby Parameter
CVE-2026-108763		Wallet System for WooCommerce < 2.8.2 - Subscriber+ KYC Document Overwrite via IDOR
CVE-2026-108686		WP Post Author < 4.2.0 - Unauthenticated reCAPTCHA Secret Key Disclosure
CVE-2026-108685		WP Post Author < 4.2.0 - Unauthenticated Modification of the First User Account's Profile
CVE-2026-105258		LatePoint < 5.7.6 - Admin+ Stored XSS via Booking Form Step Settings
CVE-2024-3586		LetterPress < 2.4.0 - Admin+ Stored XSS
CVE-2026-110030		Hide Price Until Login < 1.1.2 - Unauthenticated Account Creation via Guest Registration
CVE-2026-110983		WP Photo Album Plus < 9.3.04.004 - Photo Comment Deletion via CSRF
CVE-2026-110505		Enable SVG, WebP, and ICO Upload < 1.1.6 - Author+ Stored XSS via SMIL Animation Bypass
CVE-2026-113616		LogixFast Auth < 1.0.4 - Unauthenticated Account Takeover via Password Reset

Showing top 20 of 28 CVEs. View all on vendor page → →

IV. Related Vulnerabilities

Same product: Enable SVG, WebP, and ICO Upload

Same vendor: Unknown