SVG uploads for the Media Library, sanitized against XSS
WordPress blocks SVG uploads by default for good reason — an SVG file is really an executable XML document that can contain a <script> tag. SVG Upload allows uploading them while sanitizing every file on save, stripping out dangerous code while leaving the visual artwork untouched.
Key features
- Sanitized through the enshrined/svg-sanitize library — the same tool used by the well-known Safe SVG plugin
- Strips <script> tags, on* event-handler attributes and other XSS vectors
- Leaves the actual artwork untouched — paths, shapes, colors and viewBox stay intact
- Only users with the upload_files capability can upload SVGs, same as any other file
- A configurable file-size threshold controls sanitization behavior — heavier sanitization takes longer on large, complex SVGs
How it works
The module adds image/svg+xml to the allowed MIME types only for users with the upload_files capability, and hooks into wp_handle_upload_prefilter to run the file content through enshrined/svg-sanitize before it’s finally saved.
The sanitizer parses the SVG as XML and strips specific dangerous nodes and attributes (script, on*, foreignObject and similar) against a whitelist of allowed elements, rather than running a generic regex over the file — which is why the artwork stays visually unchanged. Files above a configurable size threshold are sanitized differently, so an unusually large file doesn’t become unnecessary server load.
An alternative to Safe SVG or SVG Support.