The SVG Support WordPress plugin before 2.5.17 does not apply its SVG sanitisation to uploaded files using the .svgz extension, even though it… (CVE-2026-13340)
The SVG Support WordPress plugin versions before 2.5.17 fail to sanitize uploaded files with the .svgz extension. Although these files are registered and served as SVGs, the lack of sanitization allows users with SVG upload permissions to upload script-bearing .svgz files. Such files can execute scripts in the browsers of users who view them, including administrators. This vulnerability has a CVSS score of 6.1, indicating a medium severity level.
AI Analysis
Technical Summary
The SVG Support WordPress plugin prior to version 2.5.17 does not apply its SVG sanitization process to files uploaded with the .svgz extension. Since .svgz files are treated and served as SVG images, this omission enables an authorized user (e.g., an Author role with SVG upload rights) to upload malicious script-bearing .svgz files. These files can then execute scripts in the browsers of any users who view them, potentially leading to cross-site scripting (XSS) attacks. The vulnerability is tracked as CVE-2026-13340 and is categorized under CWE-79 (Improper Neutralization of Input During Web Page Generation). No official patch or remediation details are provided in the source data.
Potential Impact
An attacker with permission to upload SVG files can bypass sanitization by using the .svgz extension, enabling the upload of malicious files that execute scripts in the browsers of users who view them, including administrators. This can lead to cross-site scripting attacks, compromising user sessions or performing unauthorized actions within the context of the affected WordPress site. The vulnerability does not affect availability but impacts confidentiality and integrity.
Mitigation Recommendations
Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict SVG upload permissions to trusted users only and consider disabling SVG uploads if possible. Monitor for updates from the plugin vendor regarding a patch for this issue.
The SVG Support WordPress plugin before 2.5.17 does not apply its SVG sanitisation to uploaded files using the .svgz extension, even though it… (CVE-2026-13340)
Description
The SVG Support WordPress plugin versions before 2.5.17 fail to sanitize uploaded files with the .svgz extension. Although these files are registered and served as SVGs, the lack of sanitization allows users with SVG upload permissions to upload script-bearing .svgz files. Such files can execute scripts in the browsers of users who view them, including administrators. This vulnerability has a CVSS score of 6.1, indicating a medium severity level.
CVSS v3.1
Score 6.1medium
Weaknesses
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
The SVG Support WordPress plugin prior to version 2.5.17 does not apply its SVG sanitization process to files uploaded with the .svgz extension. Since .svgz files are treated and served as SVG images, this omission enables an authorized user (e.g., an Author role with SVG upload rights) to upload malicious script-bearing .svgz files. These files can then execute scripts in the browsers of any users who view them, potentially leading to cross-site scripting (XSS) attacks. The vulnerability is tracked as CVE-2026-13340 and is categorized under CWE-79 (Improper Neutralization of Input During Web Page Generation). No official patch or remediation details are provided in the source data.
Potential Impact
An attacker with permission to upload SVG files can bypass sanitization by using the .svgz extension, enabling the upload of malicious files that execute scripts in the browsers of users who view them, including administrators. This can lead to cross-site scripting attacks, compromising user sessions or performing unauthorized actions within the context of the affected WordPress site. The vulnerability does not affect availability but impacts confidentiality and integrity.
Mitigation Recommendations
Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict SVG upload permissions to trusted users only and consider disabling SVG uploads if possible. Monitor for updates from the plugin vendor regarding a patch for this issue.
Technical Details
- Gcve Source
- db.gcve.eu
- Osv Id
- GHSA-2v5f-qf73-676h
- Osv Schema Version
- 1.4.0
- Aliases
- ["CVE-2026-13340"]
- Ecosystems
- []
- Database Specific Severity
- MODERATE
- Cvss Version
- 3.1
Threat ID: 6a71065cbf32cb7a34393e2f
Added to database: 08/03/2026, 21:21:32 UTC
Last enriched: 08/03/2026, 21:28:45 UTC
Last updated: 08/04/2026, 03:17:47 UTC
Views: 2
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.