What’s Vulnerable › Vulnerabilities

CVE-2022-1091: Safe SVG < 1.9.10 - SVG Sanitisation Bypass

• Severity: medium (CVSS 6.1 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 1.2% probability of exploitation in the next 30 days
• Public exploit or detection template: yes
• Published: 2022-04-18 · updated 2026-06-17
• Weakness: CWE-79

Description

The sanitisation step of the Safe SVG WordPress plugin before 1.9.10 can be bypassed by spoofing the content-type in the POST request to upload a file. Exploiting this vulnerability, an attacker will be able to perform the kinds of attacks that this plugin should prevent (mainly XSS, but depending on further use of uploaded SVG files potentially other XML attacks).

Affected products

• Safe SVG: before 1.9.10 — fixed in 1.9.10

How to fix

Upgrade to a fixed version: Safe SVG 1.9.10. Check the vendor advisory for mitigations.

References

• https://github.com/10up/safe-svg/pull/28
• https://wpscan.com/vulnerability/4d12533e-bdb7-411f-bcdf-4c5046db13f3
• https://github.com/10up/safe-svg/pull/28
• https://wpscan.com/vulnerability/4d12533e-bdb7-411f-bcdf-4c5046db13f3

Get alerted when CVE-2022-1091 or the next vulnerability affects your stack