CVE-2022-1091

The CVE-2022-1091 issue affects the Safe SVG WordPress plugin prior to version 1.9.10. The sanitisation step can be bypassed by spoofing the content-type in a POST request to upload an SVG file, allowing an attacker to perform XSS (and potentially other XML-related attacks depending on the SVG us...

CVE-2024-8378

The Safe SVG WordPress plugin (versions prior to 2.2.6 ) is vulnerable to Cross-Site Scripting (XSS) . The root cause is an incomplete sanitisation logic where security cleanup code only executes for paths calling wp_handle_upload, failing to cover wp_handle_sideload, which is commonly used for u...

CVE-2019-18854

The CVE-2019-18854 issue affects the WordPress Safe SVG plugin up to version 1.9.4. The root cause is an unlimited recursion triggered by a specific SVG fragment: , leading to Denial of Service. Multiple sources (WordPress ecosystem advisories and CVE aggregations) confirm the vulnerability exist...

CVE-2019-18855

The CVE-2019-18855 issue affects the WordPress Safe SVG plugin (safe-svg) up to version 1.9.4, with a Denial of Service vulnerability arising from handling of potentially unwanted elements or attributes in SVG uploads. Root cause is a DoS condition; affected installations are those running vulner...