CVE-2026-13340

Name of the Vulnerable Software and Affected Versions SVG Support WordPress plugin versions prior to 2.5.17

Description Insufficient sanitization of uploaded files with the .svgz extension allows a user with upload permissions, such as an Author, to store a file containing malicious scripts. Because the plugin registers and serves these files as SVG, the script executes in the browser of any user who views the file, including administrators. This is a stored cross-site scripting issue, where a script is permanently stored on the server and served to other users.

Recommendations Update SVG Support WordPress plugin to version 2.5.17 or later.