CVE-2026-110504
MEDIUM
MEDIUM
Priority: 0.00
BB Relevance:
49/100
Published: 2026-10-29
Modified: 2026-10-29
First seen: 2026-10-29
Status: active
Attack Surface
Network
Low Complexity
Conf. Impact
Integ. Impact
CVSS Vector Breakdown
AV:
Network
AC:
Low
PR:
High
UI:
Required
S:
Unchanged
C:
High
I:
High
A:
High
Description
The Enable SVG, WebP, and ICO Upload WordPress plugin before 1.1.6 does not sanitize uploaded SVG files whose content is not detected as SVG, while still storing and serving them as SVG images, which could allow users with the author role and above to perform Stored Cross-Site Scripting attacks.
Weakness Classification (1)
Affected Software (3)
| Vendor | Product | Version |
|---|---|---|
| Unknown | Enable SVG, WebP, and ICO Upload | 1.1.3 < 1.1.6 |
| Unknown | Enable SVG, WebP, and ICO Upload | 1.1.3 < 1.1.6 |
| Unknown | Enable SVG, WebP, and ICO Upload | 1.1.3 < 1.1.6 |