HomeWordPress vulnerabilitiesSafe SVG
Safe SVG vulnerabilities
Safe SVG has 4 known vulnerabilities in this database. The most recent published record is dated 7 Nov 2024.
- Known vulnerabilities
- 4
- Active installs
- 1m+
- Latest version
- 2.5.1
- Last updated
- 22 Sep 2026
- Most recent
- 7 Nov 2024
Find it in your WordPress dashboard under Plugins. Severity is based on the CVSS score published with the CVE where one is available.
| Vulnerability | Severity | Affected | Fix | Published |
|---|---|---|---|---|
| Security weakness CVE-2024-8378 | Medium 4.8 | Before 2.2.6 | Fixed in 2.2.6 | 7 Nov 2024 |
| Cross-site scripting (XSS) CVE-2022-1091 | Medium 6.1 | Before 1.9.10 | Fixed in 1.9.10 | 18 Apr 2022 |
| Denial of service CVE-2019-18854 | High 7.5 | Up to 1.9.4 | Fixed in a later version (latest 2.5.1) | 11 Nov 2019 |
| Denial of service CVE-2019-18855 | High 7.5 | Up to 1.9.4 | Fixed in a later version (latest 2.5.1) | 11 Nov 2019 |
Read the published descriptions
- CVE-2024-8378, 7 Nov 2024
- The Safe SVG WordPress plugin before 2.2.6 has its sanitisation code is only running for paths that call wp_handle_upload, but not for example for code that uses wp_handle_sideload which is often used to upload attachments via raw POST data. CVE record
- CVE-2022-1091, 18 Apr 2022
- The sanitisation step of the Safe SVG WordPress plugin before 1.9.10 can be bypassed by spoofing the content-type in the POST request to upload a file. Exploiting this vulnerability, an attacker will be able to perform the kinds of attacks that this plugin should prevent (mainly XSS, but depending on further use of uploaded SVG files potentially other XML attacks). CVE record
- CVE-2019-18854, 11 Nov 2019
- A Denial Of Service vulnerability exists in the safe-svg (aka Safe SVG) plugin through 1.9.4 for WordPress, related to unlimited recursion for a '<use ... xlink:href="#identifier">' substring. CVE record
- CVE-2019-18855, 11 Nov 2019
- A Denial Of Service vulnerability exists in the safe-svg (aka Safe SVG) plugin through 1.9.4 for WordPress, related to potentially unwanted elements or attributes. CVE record
What to do if you run Safe SVG
If you run Safe SVG, open WordPress and check the installed version in Plugins. Compare it with the affected versions in the vulnerability record. If a fixed version is available, take a current backup and update to that version or the latest supported release.
If no fixed version exists, consider disabling and removing the plugin or replacing it with a maintained alternative. After dealing with the affected software, check administrator users, unexpected file changes, redirects, unfamiliar pages and security logs for signs that the site may already have been altered.
Email me about new Safe SVG vulnerabilities
Free. We email you when a new vulnerability is published for Safe SVG, usually within minutes. Confirm by email; unsubscribe any time.
Focus on your business. We’ll take care of your website.
From everyday updates to ongoing care, we keep your website working.