SVG Enabler

SVG Enabler lets you upload SVG files to the WordPress media library while making sure each file is safe.

SVG is an XML format, which means it can carry JavaScript, event handler attributes, external references and XML entities. Uploading an unsanitized SVG is equivalent to allowing arbitrary HTML and JavaScript uploads. This plugin sanitizes every SVG during upload, before the file is written to your uploads directory.

What gets removed

• <script> elements and inline JavaScript
• Event handler attributes such as onload, onclick, onerror
• javascript: URLs in links and attributes
• <foreignObject> payloads
• Remote references in <image>, <use>, href and xlink:href
• Remote url() and @import rules inside <style> blocks
• XML entities and DTD declarations (XXE)
• CSS expression() and behavior: declarations

Features

• SVG and SVGZ upload support
• Sanitizes on upload, before the file reaches the uploads folder
• Uses the actively maintained enshrined/svg-sanitize library (0.22.0+)
• Correct image dimensions in the media library, editor and srcset
• Works with the block editor, classic editor and featured images
• Filterable allow-lists and capability requirements
• No settings screen required, works out of the box