Known vulnerabilities in SVG Support

Securely upload SVG files to your media library, with built-in sanitization and advanced features for styling and animation.

8Reported vulnerabilities

6.4Highest CVSS score

2.6.1Latest version

1,000,000+Active installs

What to do now

Update SVG Support to 2.5.17 or later. 8 of these have a fixed version available. Updating resolves them.

Plugin last updated: July 25, 2026 / Tested up to WordPress: 7.0.4 / View on wordpress.org

Reported vulnerabilities

Ordered by how urgently they need attention — whether a vulnerability is actually being exploited, and how likely exploitation is, rather than CVSS severity alone.

CVE	Severity	Exploit probability next 30 days	Affected versions	Fixed in	Published
CVE-2024-10222	Medium 5.4	0.5%	Before 2.5.11	`2.5.11`	February 21, 2025
CVE-2022-1755	Medium 5.4	0.6%	Before 2.5.0	`2.5.0`	September 26, 2022
CVE-2021-24686	Medium 4.8	0.7%	Before 2.3.20	`2.3.20`	February 1, 2022
CVE-2026-13340	Medium 6.4	0.2%	2.5.16 and earlier	`2.5.17`	July 24, 2026
CVE-2022-23638	Medium 5.4	0.7%	2.5.8 and earlier	`2.5.9`	February 24, 2025
CVE-2023-6708	Medium 5.4	0.3%	0 to 2.5.7 (inclusive)	`2.5.8`	July 18, 2024
CVE-2022-4022	Medium 5.4	0.4%	2.5.0 up to (but not including) 2.5.2	`2.5.2`	November 16, 2022
CVE-2026-48973	Medium 4.3	0.2%	2.5.14 and earlier	`2.5.15`	May 27, 2026

Sources: vulnerability records from NVD, exploitation from CISA KEV, exploit probability from EPSS. Affected versions come from CPE ranges or from the reporting CNA.