CVE-2026-13340

This CVE targets a sanitization bypass in a WordPress SVG handling plugin: .svgz (compressed SVG) files bypass the XML sanitization that .svg files receive, allowing stored XSS when an Author-level user uploads a malicious .svgz that executes against administrators viewing uploaded content. If you maintain or audit WordPress plugins with upload handlers, the immediate action is straightforward: audit any code paths that handle file extensions which are variants of an already-sanitized format. Search your codebase for parallel upload handlers — particularly where a new extension was added to support the same MIME type as an existing sanitized handler. The bug pattern here isn't a broken sanitizer; it's a forgotten code path. Check specifically for conditional logic that routes .svg differently from .svgz, and ensure both branches call the same sanitization function. The privilege requirement (Author role) should not minimize concern. Sites that grant Author access to external contributors, guest bloggers, or client accounts are exposing a wide attack surface. The trust model assumes uploaded content is sanitized server-side — when that contract is violated, the privilege boundary becomes a launching point rather than a containment wall. What makes this worth tracking as a pattern: this is the fourth documented SVG sanitization bypass in WordPress plugins since 2018 (CVE-2021-29462, CVE-2019-9945, and others follow the same structure). The core sanitizer works; the failure is that new format variants get parallel handlers without inheriting the security logic. Treat any code that adds a new file extension to an already-sanitized MIME type as a security-sensitive change requiring re-audit, not a configuration tweak.

Reviewed through automated stages and approved by a human before publication.