The Enable SVG, WebP, and ICO Upload WordPress plugin before version 1.1.6 fails to sanitize SVG files that are not identified as SVG, yet it still stores and serves them as SVG images. This allows users with author role or higher to embed malicious scripts into the uploaded SVG and later trigger them when the image is displayed, resulting in a stored cross‑site scripting vulnerability. The weakness is a classic input validation flaw that can compromise the confidentiality, integrity, and availability of the site and its users.

The vulnerability affects the Enable SVG, WebP, and ICO Upload plugin installations that are running any version from 1.1.3 through 1.1.5. It is not limited to a particular WordPress version but applies to any site that has the plugin before 1.1.6.

The attack vector is client‑side: an attacker must be able to upload files through the plugin interface, which requires at least author role privileges. Because the vulnerability leads to stored cross‑site scripting, any user who views the malicious SVG can become a victim. No EPSS score is available and the vulnerability is not listed in CISA KEV, but the lack of sanitization combined with exfiltration potential makes it a high‑severity risk for sites that permit SVG uploads and do not enforce strict file validation.