The Enable SVG, WebP, and ICO Upload WordPress plugin permits SVG files with animation elements to alter a link’s target to a javascript: URI. This bypasses the plugin’s sanitization routine, allowing an attacker with the author role or higher to store malicious SVG content that executes in WebKit‑based browsers such as Safari.

WordPress installations running Enable SVG, WebP, and ICO Upload earlier than version 1.1.6. Only users assigned the author role or higher can upload files, so the vulnerability is limited to sites with such permissions granted.

The vulnerability is an injection flaw that can be leveraged through file upload by any author or higher privileged user. No EPSS score is reported, and the issue is not listed in the CISA KEV catalog, but the impact is high because stored XSS can lead to credential theft, defacement, or session hijacking. Exploitation requires the attacker to own an author account or obtain one, then upload a crafted SVG file that redirects using a javascript: URI. The resulting XSS runs inside the victim’s browser context in WebKit engines.