SVG Enabler
Safely upload SVG files to WordPress. Every SVG is sanitized to remove scripts, event handlers and remote references before it is stored.
Solid choice
SVG Enabler is a solid plugin choice in 2026, with a few things worth checking first. It runs on 30+ sites and was last updated 2 weeks ago, and scores 67/100 on our health check.
- Actively developed — last update 2 weeks ago
- Tested with the latest WordPress (7.1)
- Small user base (30+ active installs)
- Very few reviews so far
Daily downloads
Download spikes usually follow a new release — each site that auto-updates counts as a download.
Rankings
Where SVG Enabler stands todayWordPress.org search rankings
Live position in the plugin search, top 100| Keyword | Position |
|---|---|
| allow svg upload | #29 |
| SVG | #54 |
| svg sanitizer | #9 |
| svg support | #39 |
| svg upload | #39 |
Version adoption
Share of active sites per release.
About SVG Enabler
From the official readme · v2.0.0Description
SVG Enabler lets you upload SVG files to the WordPress media library while making sure each file is safe.
SVG is an XML format, which means it can carry JavaScript, event handler attributes, external references and XML entities. Uploading an unsanitized SVG is equivalent to allowing arbitrary HTML and JavaScript uploads. This plugin sanitizes every SVG during upload, before the file is written to your uploads directory.
What gets removed
<script>elements and inline JavaScript- Event handler attributes such as
onload,onclick,onerror javascript:URLs in links and attributes<foreignObject>payloads- Remote references in
<image>,<use>,hrefandxlink:href - Remote
url()and@importrules inside<style>blocks - XML entities and DTD declarations (XXE)
- CSS
expression()andbehavior:declarations
Features
- SVG and SVGZ upload support
- Sanitizes on upload, before the file reaches the uploads folder
- Uses the actively maintained
enshrined/svg-sanitizelibrary (0.22.0+) - Correct image dimensions in the media library, editor and srcset
- Works with the block editor, classic editor and featured images
- Filterable allow-lists and capability requirements
- No settings screen required, works out of the box
Installation
INSTALL “SVG Enabler” FROM WITHIN WORDPRESS
- Visit the plugins page within your dashboard and select ‘Add New’;
- Search for ‘SVG Enabler’;
- Activate SVG Enabler from your Plugins page;
- You are done. Upload an SVG from the media library.
INSTALL “SVG Enabler” MANUALLY
- Upload the ‘svg-enabler’ folder to the /wp-content/plugins/ directory;
- Activate the SVG Enabler through the ‘Plugins’ menu in WordPress;
- You are done.
Frequently asked questions
Who can upload SVG files?
By default only administrators (users with the manage_options capability) can upload SVG files. Everyone else is blocked, because SVG is the one image format that can execute code. You can change this with the optimisthub_svg_enabler_capability filter. For example, to let editors upload SVG as well: add_filter( 'optimisthub_svg_enabler_capability', function ( $capability ) { return 'edit_others_posts'; } ); Return an empty string to allow anyone who can upload files.
Can we change the allowed attributes and tags?
Yes, this can be done using the optimisthub_svg_enabler_allowed_attributes and optimisthub_svg_enabler_allowed_tags filters. They take one argument that must be returned. add_filter( 'optimisthub_svg_enabler_allowed_attributes', function ( $attributes ) { $attributes[] = 'target'; // This would allow the target="" attribute. return $attributes; } ); add_filter( 'optimisthub_svg_enabler_allowed_tags', function ( $tags ) { $tags[] = 'use'; // This would allow the element. return $tags; } );
Why was my SVG rejected?
The file either was not valid XML, did not contain an root element, or could not be sanitized. Rejected files are never stored. Try re-saving the file with a vector editor such as Inkscape or Illustrator.
Does this plugin make SVG safe to use?
It removes the known dangerous constructs from uploaded SVG files and keeps the sanitizer library up to date. No sanitizer can be considered a complete guarantee, which is why upload permission is restricted to administrators by default. Only upload SVG files from sources you trust.
Does it work with SVGZ?
Yes, .svgz files use the same MIME type and are sanitized the same way.
Changelog
Security release. Fixes two sanitizer bypasses and an upstream library affected by CVE-2025-55166, and fixes a fatal error that broke SVG uploads. Upgrading is strongly recommended.
2.0.0
Security
- Fixed a sanitizer bypass: remote references in
href,xlink:href,srcand similar attributes are now removed. Previously an uploaded SVG could contact an external server. - Fixed a sanitizer bypass:
@import, remoteurl()references,expression()andbehavior:inside<style>blocks are now removed. - Upgraded
enshrined/svg-sanitizefrom 0.15.4 to 0.22.0. The old version was affected by CVE-2025-55166, CVE-2022-23638 and CVE-2019-10772. - SVG uploads now require the
manage_optionscapability by default, instead of relying onunfiltered_upload, which WordPress only grants on multisite.
Fixed
- Fixed a fatal error on every SVG upload:
svgFileValidator()called$this->sanitize(), a method that did not exist. - Fixed a fatal error caused by registering
svgFileValidator()forwp_check_filetype_and_extwith four accepted arguments while the callback only accepted one. - Removed a recursive call to
wp_check_filetype_and_ext()from inside its own filter. - Fixed undefined
$widthand$heightvariables ingetImageTagOverride()when$sizewas not an array. - Fixed the
optimisthub_svg_enabler_allowed_attributesand_allowed_tagsfilters being applied but their return values discarded, which made both filters do nothing. - Fixed SVG images rendering as 1×1 pixels in the editor and on the front end. Real width and height are now derived from the SVG’s
width/heightorviewBox. - Fixed srcset generating broken entries for SVG attachments.
- Added a media library preview and correct attachment dimensions.
Changed
- Rewritten as a namespaced, PSR-4 autoloaded plugin (
OptimistHub\SvgEnabler). - Sanitization now runs before the file is moved into the uploads directory.
- Added
composer.jsonso dependencies are reproducible; the previouscomposer.jsonwas excluded by.gitignore. - Requires WordPress 6.0 and PHP 7.4 or newer.
- The plugin now refuses to enable SVG uploads when PHP lacks the
domandlibxmlextensions, and shows an admin notice explaining why.
1.0.3
- Author name issue.
1.0.2 – 1.0.1
- Github Action
1.0.0
- Stable version released
For developers
Is this your plugin? Show off the numbers.
Add a live badge to your site, docs or GitHub README. It updates on its own — no account needed.
FAQ
SVG Enabler: quick answers
Straight answers, pulled from live WordPress.org data.
Live data from WordPress.org · checked Oct 16, 2026
Is SVG Enabler free?
Yes. SVG Enabler is free to download and use from the official WordPress.org plugin directory.
Is SVG Enabler safe to use in 2026?
SVG Enabler is a solid plugin choice in 2026, with a few things worth checking first. It runs on 30+ sites and was last updated 2 weeks ago, and scores 67/100 on our health check.
How many websites use SVG Enabler?
SVG Enabler is active on 30+ WordPress websites and has been downloaded 3,271 times since it launched in January 2023. It was downloaded 166 times in the last 30 days.
Does SVG Enabler work with WordPress 7.1?
Yes. The developer has tested SVG Enabler up to WordPress 7.1.3, the latest release. It requires WordPress 6.0 or newer.
What PHP version does SVG Enabler need?
SVG Enabler requires PHP 7.4 or higher. Most hosts run PHP 8.x today, so it works on any modern WordPress hosting.
When was SVG Enabler last updated?
The latest version, 2.0.0, was released on October 4, 2026 (2 weeks ago).
Who makes SVG Enabler?
SVG Enabler is developed and maintained by Optimist Hub.
Powered by PageForge
Want thousands of pages that rank like these? Build them in an afternoon.
This directory runs on the same engine as PageForge. Turn any spreadsheet, CSV or API into thousands of fast, SEO-ready WordPress pages — with schema, internal links and AI-written copy baked in.
- CSV, Google Sheets & API data sources
- AI content, schema & internal links per page
- Works with Elementor, Gutenberg, Yoast & Rank Math
- Free on WordPress.org — no credit card
