CVE-2026-13340
SVG Support < 2.5.17 - Author+ Stored XSS via .svgz Sanitization Bypass
CVSS Score
0.0
EPSS Score
0.0%
EPSS Percentile
0th
The SVG Support WordPress plugin before 2.5.17 does not apply its SVG sanitisation to uploaded files using the .svgz extension, even though it registers and serves them as SVG, allowing a user permitted to upload SVGs (such as an Author once granted upload access) to store a script-bearing file that executes in the browser of anyone who later views it, including an administrator.
| Vendor | unknown |
| Product | svg support |
| Published | Aug 3, 2026 |
Stay Ahead of the Next One
Get instant alerts for unknown svg support
Be the first to know when new unknown vulnerabilities affecting unknown svg support are published — delivered to Slack, Telegram or Discord.
Get Free Alerts →
Free · No credit card · 60 sec setup
Affected Versions
Unknown / SVG Support
0 < 2.5.17
References
Credits
Shivamani Vastrala WPScan