CVE-2026-13340

The SVG Support WordPress plugin is vulnerable to a security flaw due to its failure to properly sanitize uploaded files with the .svgz extension. This oversight allows malicious users, even those with limited permissions like Authors granted upload access, to upload and store scripts that can be executed by anyone viewing the file, including administrators.

Based on public CVE data (MITRE/NVD).