Medium severity · published Oct 29, 2026
CVE-2026-110505
Enable SVG, WebP, and ICO Upload < 1.1.6 - Author+ Stored XSS via SMIL Animation Bypass
New
6.8
CVSS
–
EPSS
No
On KEV
Description
The Enable SVG, WebP, and ICO Upload WordPress plugin before 1.1.6 does not prevent animation elements in uploaded SVG files from changing a link's target to a javascript: URI, which could allow users with the author role and above to bypass its SVG sanitization and perform Stored Cross-Site Scripting attacks that execute in WebKit-based browsers such as Safari.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:H/I:H/A:H
Attack vector
Network
Complexity
Low
Privileges
High
User interaction
Required
Confidentiality
High
Integrity
High
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
ES
Enable SVG, WebP, and ICO Upload ·
before 1.1.6 · source: vendor
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2026-110505
CVE.org
https://www.cve.org/CVERecord?id=CVE-2026-110505
exploit
https://wpscan.com/vulnerability/5fc2b6c9-a9e6-48c2-99ec-7912da3297ae/
More from Enable SVG, WebP, and ICO Upload
6.8
CVE-2026-110504
Enable SVG, WebP, and ICO Upload 1.1.3 - 1.1.5 - Author+ Stored XSS via SVG Sanitization Bypass