#48 by installs
SVG Support
Securely upload SVG files to your media library, with built-in sanitization and advanced features for styling and animation.
- Installs
- 1+ million
- Rating
- 4.8 (356)
- Updated
- Today
Safe SVG
Enable SVG uploads and sanitize them to stop XML/SVG vulnerabilities in your WordPress website.
- Active installs
- 1+ million
- #54 of 1,000
- Downloads, all time
- 14.7M
- 14,747,822
- Downloads, 30 days
- 569.6K
- 353K in the last 7
- Rating
- 4.9 / 5
- 79 reviews
- Last updated
- 5 days ago
- Oct 26, 2026
- Version
- 2.5.2
- 57 releases
Upkeep and compatibility
| Last updated | October 26, 2026Updated in the last 3 months |
|---|---|
| Tested up to | WordPress 7.1.4Covers WordPress 7.1.4, the current release |
| Needs WordPress | 6.9 or newer |
| Needs PHP | 7.4 or newer |
| First published | July 3, 2015 |
| Support, last two months | No threads opened |
Reviews
4.9 / 5 from 79 reviews
| 5 stars | 71 |
|---|---|
| 4 stars | 7 |
| 3 stars | 0 |
| 2 stars | 1 |
| 1 star | 0 |
Downloads, last 30 days
What the author says it does
Safe SVG is the best way to Allow SVG Uploads in WordPress!
It gives you the ability to allow SVG uploads whilst making sure that they’re sanitized to stop SVG/XML vulnerabilities affecting your site. It also gives you the ability to preview your uploaded SVGs in the media library in all views.
Current Features
- Sanitised SVGs – Don’t open up security holes in your WordPress site by allowing uploads of unsanitised files.
- SVGO Optimisation – Runs your SVGs through the SVGO tool on upload to save you space. This feature is disabled by default but can be enabled by adding the following code: add_filter( 'safe_svg_optimizer_enabled', '__return_true' );
- View SVGs in the Media Library – Gone are the days of guessing which SVG is the correct one, we’ll enable SVG previews in the WordPress media library.
- Choose Who Can Upload – Restrict SVG uploads to certain users on your WordPress site or allow anyone to upload.
Initially a proof of concept for #24251.
SVG Sanitization is done through the following library: https://github.com/darylldoyle/svg-sanitizer.
SVG Optimization is done through the following library: https://github.com/svg/svgo.
Technical: Upload Path Security
The opening of the plugin's own description. The full text, installation notes and changelog are on its WordPress.org page.
Questions the author answers
Can we change the allowed attributes and tags?
Yes, this can be done using the svg_allowed_attributes and svg_allowed_tags filters.
They take one argument that must be returned. See below for examples:
add_filter( 'svg_allowed_attributes', function ( $attributes ) {
// Do what you want here...
// This should return an array so add your attributes to // to the $attributes array before returning it. E.G.
Can my theme style an inline SVG?
Mostly, yes. The Inline SVG block renders an SVG that carries its own <style> element inside a shadow root, because CSS inside an inline SVG is otherwise applied to the whole page rather than just the SVG. Stylesheets cannot reach into a shadow root, so theme CSS such as .entry-content svg { fill: red; } will not apply to those SVGs.
Why doesn’t Safe SVG globally enable SVG uploads?
Safe SVG only allows SVGs through upload paths it can actively sanitize. While most WordPress uploads use standard functions like wp_handle_upload() (which Safe SVG hooks), plugins and themes can create custom upload paths by calling WordPress’s underlying _wp_handle_upload() function with arbitrary action parameters.
Where do I report security bugs found in this plugin?
Please report security bugs found in the source code of the Safe SVG plugin through the Patchstack Vulnerability Disclosure Program. The Patchstack team will assist you with verification, CVE assignment, and notify the developers of this plugin.
Latest changelog entry
- Added: New filter, safe_svg_max_inflated_size, allowing you to increase or decrease the max size an SVG can inflate to (GHSA-xjvq-4jwj-3mwq).
- Security: Updates the underlying enshrined/svg-sanitize package to v1.1.0 (#355).
- Security: Resolve GHSA-xjvq-4jwj-3mwq (GHSA-xjvq-4jwj-3mwq).
- Security: Resolve GHSA-xpv8-cx9q-v65f (GHSA-xpv8-cx9q-v65f).
- Security: Resolve GHSA-h56m-22q9-r6xc (GHSA-h56m-22q9-r6xc).
- Security: Resolve GHSA-vm75-mq6x-x57m (GHSA-vm75-mq6x-x57m).
Tagged
Plugins that share its tags
Firewall, Malware Scanner, Two Factor Auth, and Comprehensive Security Features, powered by our 24-hour team. Make security a priority with Wordfence.
- Installs
- 5+ million
- Rating
- 4.7 (5K)
- Updated
- 31 days ago
#17 by installs
Jetpack – AI Agents & MCP, Security, Backup & Analytics
Connect ChatGPT, Claude, or another AI agent to your site. Plus backup, malware scan, firewall, stats, CDN, and SEO tools in one plugin.
- Installs
- 3+ million
- Rating
- 3.7 (2.4K)
- Updated
- 4 days ago
Easily improve site security with WordPress Hardening, Two-Factor Authentication (2FA), Login Protection, Vulnerability Detection and SSL certificate.
- Installs
- 3+ million
- Rating
- 4.9 (8.9K)
- Updated
- 5 days ago
#20 by installs
Hostinger Tools
Simplified WordPress management. Manage site info, maintenance, security, & redirects.
- Installs
- 3+ million
- Rating
- 3.5 (40)
- Updated
- 10 days ago
WordPress login security with brute force protection, Two-factor authentication (2FA/MFA), firewall, IP/country blocking, and login monitoring
- Installs
- 1+ million
- Rating
- 4.8 (1.5K)
- Updated
- 38 days ago
Where this page's numbers come from
Read from the WordPress.org plugin API on , when WordPress 7.1.4 was the current release. WordPress.org rounds active installs into buckets. These are the directory's figures, not my verdict, and I haven't tested this plugin.