Directory / plugin
SVG Enabler
v2.0.0 · by Optimist Hub
Safely upload SVG files to WordPress. Every SVG is sanitized to remove scripts, event handlers and remote references before it is stored.
About this plugin
SVG Enabler lets you upload SVG files to the WordPress media library while making sure each file is safe.
SVG is an XML format, which means it can carry JavaScript, event handler attributes, external references and XML entities. Uploading an unsanitized SVG is equivalent to allowing arbitrary HTML and JavaScript uploads. This plugin sanitizes every SVG during upload, before the file is written to your uploads directory.
What gets removed
<script>elements and inline JavaScript- Event handler attributes such as
onload,onclick,onerror javascript:URLs in links and attributes<foreignObject>payloads- Remote references in
<image>,<use>,hrefandxlink:href - Remote
url()and@importrules inside<style>blocks - XML entities and DTD declarations (XXE)
- CSS
expression()andbehavior:declarations
Features
- SVG and SVGZ upload support
- Sanitizes on upload, before the file reaches the uploads folder
- Uses the actively maintained
enshrined/svg-sanitizelibrary (0.22.0+) - Correct image dimensions in the media library, editor and srcset
- Works with the block editor, classic editor and featured images
- Filterable allow-lists and capability requirements
- No settings screen required, works out of the box