CVE-2026-13340: SVG Support WordPress Plugin XSS Flaw

CVE-2026-13340 Overview

CVE-2026-13340 is a stored cross-site scripting (XSS) vulnerability in the SVG Support WordPress plugin before version 2.5.17. The plugin registers and serves .svgz files as SVG content but fails to apply its sanitization routine to files uploaded with that extension. Any user with SVG upload permissions, such as an Author granted upload access, can store a script-bearing .svgz file. The malicious script then executes in the browser of any visitor who views the file, including administrators. The flaw is tracked under CWE-79 (Improper Neutralization of Input During Web Page Generation).

Critical Impact
An authenticated low-privilege user can achieve script execution in an administrator's browser session, enabling account takeover of the WordPress site.

Affected Products

SVG Support WordPress plugin versions prior to 2.5.17
WordPress installations that grant upload permissions to Author-level or higher accounts
Sites configured to allow SVG uploads through the SVG Support plugin

Discovery Timeline

2026-08-03 - CVE-2026-13340 published to the National Vulnerability Database
2026-08-03 - Last updated in NVD database

Technical Details for CVE-2026-13340

Vulnerability Analysis

The SVG Support plugin extends WordPress to accept and render Scalable Vector Graphics (SVG) files. Because raw SVG is XML that can contain <script> elements and event handler attributes, the plugin implements a sanitization pipeline that strips executable content from SVG uploads before storage. This sanitization is applied to files with the .svg extension.

The plugin also registers .svgz as a supported extension. An .svgz file is a gzip-compressed SVG that the browser decompresses and renders as an SVG document. The plugin serves .svgz uploads with the image/svg+xml MIME type, causing browsers to parse the decompressed XML and execute embedded scripts.

The sanitization function is not invoked for the .svgz code path. An attacker who is permitted to upload SVGs can craft a gzipped SVG containing a <script> element or an onload handler, upload it with the .svgz extension, and bypass sanitization entirely. When an administrator later browses the media library or opens the attachment URL, the payload executes in the administrator's authenticated session.

Root Cause

The root cause is inconsistent input validation across file extensions that the plugin treats as equivalent. The sanitizer is gated on the .svg extension string rather than on the effective content type or the decompressed payload. Registering .svgz as an allowed upload type without extending sanitization to compressed variants creates a parser differential between the plugin's validation logic and the browser's rendering logic.

Attack Vector

Exploitation requires an account with SVG upload permissions and interaction from a victim who views the uploaded file. The attacker gzip-compresses a malicious SVG containing JavaScript, uploads it through the WordPress media uploader as payload.svgz, and then shares or waits for the attachment URL to be viewed. Because the file is served in the site's origin, the executed script has full access to the victim's session cookies, nonces, and any administrative REST endpoints the victim can reach. This can be chained to create new administrator accounts or install arbitrary plugins.

Technical details are documented in the WPScan Vulnerability Report.

Detection Methods for CVE-2026-13340

Indicators of Compromise

Files with the .svgz extension present in the WordPress wp-content/uploads/ directory tree
Media library attachments whose decompressed content contains <script>, onload=, onerror=, or javascript: strings
Unexpected administrator account creation or plugin installation events following media library access
Outbound requests from administrator browsers to attacker-controlled domains after viewing an attachment page

Detection Strategies

Scan the uploads directory for .svgz files and decompress each with gunzip to inspect the underlying XML for script content and event handler attributes
Query the wp_posts table for attachments with post_mime_type = 'image/svg+xml' and cross-reference file extensions on disk
Review WordPress access logs for GET requests to .svgz resources followed by administrative API calls from the same session

Monitoring Recommendations

Enable WordPress audit logging for user role changes, plugin installations, and option updates that follow media library activity
Alert on creation of new administrator accounts or modifications to the active_plugins option outside change windows
Monitor for anomalous outbound connections from browsers rendering WordPress admin pages

How to Mitigate CVE-2026-13340

Immediate Actions Required

Update the SVG Support plugin to version 2.5.17 or later on all WordPress installations
Audit existing .svgz files in the media library and remove any that contain executable content
Review Author and Contributor accounts that have been granted SVG upload permissions and revoke access where it is not required
Rotate administrator passwords and invalidate active sessions if suspicious .svgz uploads are found

Patch Information

The vendor addressed the issue in SVG Support version 2.5.17 by extending the sanitization routine to .svgz uploads. See the WPScan Vulnerability Report for advisory details and version references.

Workarounds

Disable SVG upload permissions for non-administrator roles until the plugin is patched
Configure the web server to serve .svgz files with a Content-Disposition: attachment header, forcing download rather than inline rendering
Deploy a web application firewall rule that inspects uploads for the gzip magic bytes 1f 8b when the extension is .svgz and blocks payloads containing script markers after decompression

bash

# Nginx configuration to force download of .svgz attachments
location ~* \.svgz$ {
    add_header Content-Disposition "attachment";
    add_header Content-Security-Policy "script-src 'none'; object-src 'none'";
}