The Easy SVG Support plugin for WordPress is vulnerable to Stored Cross-Site Scripting via SVG file uploads in all versions up to, and including, 4.0 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Author-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses the SVG file.
Metrics
Affected Vendors & Products
| Vendors | Products |
|---|---|
| Benjaminzekavica |
|
| Wordpress |
|
No data.
No data.
References
History
Thu, 19 Feb 2026 10:30:00 +0000
| Type | Values Removed | Values Added |
|---|---|---|
| First Time appeared |
Benjaminzekavica
Benjaminzekavica easy Svg Support Wordpress Wordpress wordpress |
|
| Vendors & Products |
Benjaminzekavica
Benjaminzekavica easy Svg Support Wordpress Wordpress wordpress |
Thu, 19 Feb 2026 04:15:00 +0000
| Type | Values Removed | Values Added |
|---|---|---|
| Description | The Easy SVG Support plugin for WordPress is vulnerable to Stored Cross-Site Scripting via SVG file uploads in all versions up to, and including, 4.0 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Author-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses the SVG file. | |
| Title | Easy SVG Support <= 4.0 - Authenticated (Author+) Stored Cross-Site Scripting via SVG File Upload | |
| Weaknesses | CWE-79 | |
| References |
|
|
| Metrics |
cvssV3_1
|
MITRE
Status: PUBLISHED
Assigner: Wordfence
Published: 2026-02-19T03:25:13.845Z
Updated: 2026-02-19T03:25:13.845Z
Reserved: 2025-10-28T20:47:55.593Z
Link: CVE-2025-12451
Vulnrichment
No data.
NVD
No data.
Redhat
No data.