CVE-2026-13340 is a cross-site scripting (XSS) vulnerability in the SVG Support WordPress plugin. The plugin does not apply its SVG sanitization process to files with the .svgz extension, despite serving them as SVG images. This oversight enables users with upload privileges to store malicious script content within .svgz files. When these files are viewed, the embedded scripts execute in the context of the viewer's browser, potentially compromising user sessions or site integrity. The vulnerability affects all versions before 2.5.17 of the plugin. No official patch or remediation guidance is currently provided by the vendor.

An attacker with upload permissions can upload malicious .svgz files containing executable scripts. These scripts run in the browsers of users who view the files, including administrators, leading to potential session hijacking, privilege escalation, or other client-side attacks typical of XSS vulnerabilities. This undermines site security and user trust.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict SVG upload permissions to trusted users only and avoid uploading .svgz files. Monitor for updates from the plugin vendor regarding a security patch.