Description

Safe SVG est le meilleur moyen d’autoriser les téléversements de SVG dans WordPress !

Il vous permet d’autoriser les téléversements de SVG tout en vous assurant qu’ils soient nettoyés pour éliminer les vulnérabilités SVG/XML qui peuvent affecter votre site.
Il vous donne également la possibilité de prévisualiser dans la médiathèque vos SVG téléversés.

Fonctionnalités actuelles

SVG désinfectés – N’ouvrez pas de failles de sécurité de votre site WordPress en autorisant les téléversements de fichiers non contrôlés.
Optimisation SVGO – Exécute vos SVG via l’outil SVGO lors du téléversement pour vous faire gagner de la place. Cette fonctionnalité est désactivée par défaut mais peut être activée en ajoutant le code suivant : add_filter( 'safe_svg_optimizer_enabled', '__return_true' );
Afficher les SVG dans la médiathèque – Fini le temps où il fallait deviner quel SVG est le bon, nous activerons les aperçus SVG dans la médiathèque de WordPress.
Choisissez qui peut téléverser – Limitez les téléversements de SVG à certains utilisateurs de votre site WordPress ou autorisez n’importe qui à en téléverser.

Initialement une preuve de concept pour #24251.

La normalisation SVG est effectuée avec la bibliothèque suivante : https://github.com/darylldoyle/svg-sanitizer.

L’optimisation des SVG est effectuée via la bibliothèque suivante : https://github.com/svg/svgo.

Technical: Upload Path Security

WordPress’s _wp_handle_upload( $file, $action ) function allows any $action value, which determines the filter hook name: {$action}_prefilter. Safe SVG hooks common actions like wp_handle_upload and wp_handle_sideload, but cannot hook arbitrary custom actions defined by third-party code. Since upload actions are unbounded and MIME allowances are global, we cannot guarantee sanitization coverage across all possible upload paths.

Blocs

Cette extension fournit 1 bloc.

Safe SVG Display the SVG icon

Installation

Installez via le répertoire WordPress ou téléchargez, décompressez et téléversez les fichiers dans votre répertoire /wp-content/plugins/

FAQ

Pouvons-nous modifier les attributs et les balises autorisés ?

Oui, cela peut être fait en utilisant les filtres svg_allowed_attributes et svg_allowed_tags.
Ils prennent un argument qui doit être retourné. Voir ci-dessous pour des exemples :

add_filter( 'svg_allowed_attributes', function ( $attributes ) {

    // Do what you want here...

    // This should return an array so add your attributes to
    // to the $attributes array before returning it. E.G.

    $attributes[] = 'target'; // This would allow the target="" attribute.

    return $attributes;
} );


add_filter( 'svg_allowed_tags', function ( $tags ) {

    // Do what you want here...

    // This should return an array so add your tags to
    // to the $tags array before returning it. E.G.

    $tags[] = 'use'; // This would allow the <use> element.

    return $tags;
} );

Can my theme style an inline SVG?

Mostly, yes. The Inline SVG block renders an SVG that carries its own <style> element inside a shadow root, because CSS inside an inline SVG is otherwise applied to the whole page rather than just the SVG. Stylesheets cannot reach into a shadow root, so theme CSS such as .entry-content svg { fill: red; } will not apply to those SVGs.

Inherited properties still cross the boundary, so setting color on an ancestor and using currentColor inside the SVG works, as do CSS custom properties. SVGs that do not contain a <style> element are rendered without the shadow root and can be styled by theme stylesheets.

To turn isolation off, at the cost of allowing an SVG’s CSS to affect the rest of the page:

add_filter( 'safe_svg_inline_use_shadow_dom', '__return_false' );

Why doesn’t Safe SVG globally enable SVG uploads?

Safe SVG only allows SVGs through upload paths it can actively sanitize. While most WordPress uploads use standard functions like wp_handle_upload() (which Safe SVG hooks), plugins and themes can create custom upload paths by calling WordPress’s underlying _wp_handle_upload() function with arbitrary action parameters.

Globally enabling the image/svg+xml MIME type would allow SVGs through all upload paths—including custom ones Safe SVG cannot intercept and sanitize. This would create security vulnerabilities where unsanitized SVGs containing malicious scripts could be uploaded.

This is a deliberate design decision: Safe SVG prioritizes guaranteed sanitization over broad compatibility. SVGs are only allowed when we can ensure they’re safe.

Where do I report security bugs found in this plugin?

Please report security bugs found in the source code of the Safe SVG plugin through the Patchstack Vulnerability Disclosure Program. The Patchstack team will assist you with verification, CVE assignment, and notify the developers of this plugin.

Avis

Karolina Vyskocilova 6 août 2026 1 réponse

Must use plugin, well maintained, installing almost every time and just now I've realized, that I didn't review it. Keep it up and thanks!

jeeni 22 avril 2026 1 réponse

Very helpful plugin, thanks!

devlin1 11 mars 2026 1 réponse

Needed SVG upload support, and this plugin did the job. Very lightweight and easy to use. No issues so far. Some additional settings would be nice, but overall, it's quite solid.

Reza Asadi 19 novembre 2025 1 réponse

Nice And Easy plugin for using SVG files

rrvoigt 21 juin 2025 1 réponse

Would have given a 5 star, but it seems support is missing for the taxonomy / terms section (like in categories) upload for SVG images. Keep getting an error that the upload isn't supported. Hopefully this will be fixed in a future update. Will update once this is added. Cheers!

Stefano 30 avril 2025 1 réponse

Great plugin! very usefull, but please can you add the possibility to add an inline SVG on the block pasting svg code? Thanks!

Lire les 79 avis

Contributeurs/contributrices & développeurs/développeuses

« Safe SVG » est un logiciel libre. Les personnes suivantes ont contribué à cette extension.

“Safe SVG” a été traduit dans 30 locales. Remerciez l’équipe de traduction pour ses contributions.

Traduisez « Safe SVG » dans votre langue.

Le développement vous intéresse ?

Parcourir le code, consulter le SVN dépôt, ou s’inscrire au journal de développement par RSS.

Journal des modifications

2.5.0 – 2026-09-07

Security: Prevented direct access of PHP files (props @mehrazmorshed, @dkotter via #300).
Security: The Inline SVG block now renders SVGs that carry their own <style> element inside a shadow root, so their CSS is scoped to the block instead of applying to the whole page (props @darylldoyle, @dkotter, @jeffpaul, @peterwilsoncc via #328).
Security: Bump enshrined/svg-sanitize from ^0.22.0 to ^1.0.0 to pull in security fixes (props @dkotter, @jeffpaul, @peterwilsoncc via #327).
Added: Link support for the SVG Inline block, including URL input, new tab toggle, and nofollow/sponsored rel options (props @vegetable-bits, @mgiannopoulos24, @jeffpaul, @thrijith, @peterwilsoncc, @dkotter, @pbiron via #315).
Added: New safe_svg_inline_use_shadow_dom filter to control which inline SVGs are isolated in a shadow root, and new safe_svg_inline_shadow_styles filter to adjust the CSS injected alongside them (props @darylldoyle, @dkotter, @jeffpaul, @peterwilsoncc via #328).
Added: New safe_svg_remove_remote_references filter to strip remote url(), @import and image-set() references, along with remote href targets, from uploaded SVGs. Off by default, because legitimate SVGs reference remote fonts and images but use this filter to turn it on (props @darylldoyle, @dkotter, @jeffpaul, @peterwilsoncc via #328).
Added: Added support for Enable Media Replace plugin (props @gthayer, @jeffpaul, @peterwilsoncc via #285).
Changed: Bump WordPress minimum supported version to 6.9 (props @zamanq, @peterwilsoncc via #320).
Changed: Bump « tested up to header » to indicate WordPress 7.1 support (props @navi151, @peterwilsoncc, @dkotter, @jeffpaul, @zamanq via #290, #311, #320).
Changed: Theme CSS can no longer target an inline SVG that carries its own <style> element, because stylesheets cannot reach into a shadow root. Style those SVGs from within the SVG itself, or opt out with the safe_svg_inline_use_shadow_dom filter. Inherited properties, including color/currentColor and custom properties, still apply as before, and SVGs without a <style> element are unaffected (props @darylldoyle, @dkotter, @jeffpaul, @peterwilsoncc via #328).
Changed: Updated blueprint file for WordPress.org live previews (props @fellyph, @jeffpaul, @peterwilsoncc via #287).
Changed: Bump svgo from 3.2.0 to 3.3.5 (props @dependabot[bot], @jeffpaul, @peterwilsoncc, @dependabot via #309).

2.4.0 – 2025-09-22

Added: Ability to upload SVGs from more admin locations (props @stormrockwell, @darylldoyle, @wpexplorer, @smerriman, @jeffpaul, @dkotter via #279).
Changed: Added $attachment_id argument to filters safe_svg_use_width_height_attributes and safe_svg_dimensions (props @roborourke, @dkotter via #278).
Fixed: Inconsistent or incorrect data type for $svg argument in the filters safe_svg_use_width_height_attributes and safe_svg_dimensions (props @roborourke, @dkotter via #278).

2.3.3 – 2025-08-13

Security: Update the enshrined/svg-sanitize package from 0.19.0 to 0.22.0 to fix an issue with case-insensitive attributes slipping through the sanitiser and address PHP 8.4 deprecation warnings (props @darylldoyle, @sudar, @georgestephanis, @dkotter, @realazizk via #268, #272).
Security: Bump form-data from 4.0.0 to 4.0.4 (props @dependabot, @faisal-alvi via #270).
Security: Bump tmp from 0.2.3 to 0.2.5 and @inquirer/editor from 4.2.9 to 4.2.16 (props @dependabot, @dkotter via #271).

2.3.2 – 2025-07-21

Fixed: Visual parity between the front end and the block editor (props @s3rgiosan, @dkotter via #261, #266).
Changed: Bump WordPress « tested up to » version 6.8 (props @godleman, @jeffpaul, @dkotter via #251, #254).
Changed: Bump WordPress minimum supported version to 6.6 (props @godleman, @jeffpaul, @dkotter via #254).
Security: Bump ws from 7.5.10 to 8.18.0, @wordpress/scripts from 27.9.0 to 30.6.0, nanoid from 3.3.7 to 3.3.8 and mocha from 10.2.0 to 11.0.1 (props @dependabot, @peterwilsoncc via #245).
Security: Bump @babel/runtime from 7.23.9 to 7.27.0, axios from 1.7.4 to 1.8.4, cookie from 0.4.2 to 0.7.1, express from 4.21.0 to 4.21.2 and @wordpress/e2e-test-utils-playwright from 0.26.0 to 1.20.0 (props @dependabot, @dkotter via #250).
Security: Bump http-proxy-middleware from 2.0.6 to 2.0.9 (props @dependabot, @iamdharmesh via #253).
Security: Bump tar-fs from 3.0.8 to 3.0.9 (props @dependabot, @dkotter via #258).
Security: Bump bytes from 3.0.0 to 3.1.2 and compression from 1.7.4 to 1.8.1 (props @dependabot, @dkotter via #265).

2.3.1 – 2024-12-05

Fixed: Revert changes made to how we determine custom dimensions for SVGs (props @dkotter, @martinpl, @subfighter3, @smerriman, @gigatyrant, @jeffpaul, @iamdharmesh via #238).

2.3.0 – 2024-11-25

Added: New setting that allows large SVG files (roughly 10MB or greater) to be uploaded and sanitized properly (props @kirtangajjar, @faisal-alvi, @darylldoyle, @manojsiddoji, @dkotter via #201).
Added: New get_svg_dimensions function in order to reduce code duplication (props @gabriel-glo, @jeremymoore, @darylldoyle, @iamdharmesh, @dkotter via #216).
Changed: Updated the enshrined/svg-sanitize package from 0.16.0 to 0.19.0 to fix a PHP 8.3 compatibility issue (props @sksaju, @TylerB24890, @darylldoyle, @rolf-yoast, @faisal-alvi via #214).
Changed: Update how image dimensions are passed in get_image_tag_override and one_pixel_fix methods (props @gabriel-glo, @jeremymoore, @darylldoyle, @iamdharmesh, @dkotter via #216).
Changed: Bump WordPress « tested up to » version to 6.7 (props @colinswinney, @jeffpaul via #232, #233).
Changed: Bump WordPress minimum from 6.4 to 6.5 (props @colinswinney, @jeffpaul via #232, #233).
Changed: Remove composer dev dependencies from archived project (props @TylerB24890, @szepeviktor, @peterwilsoncc via #220).
Fixed: Use proper block category for the Safe SVG Icon block (props @kirtangajjar, @fabiankaegy via #226).
Security: Only allow SVG file types to be uploaded if our sanitizer is able to run on those files (props @darylldoyle, @xknown, @dkotter via #228).
Security: Bump webpack from 5.90.1 to 5.94.0 (props @dependabot, @peterwilsoncc via #222).
Security: Bump ws from 7.5.10 to 8.18.0, serve-static from 1.15.0 to 1.16.2 and express from 4.19.2 to 4.21.0 (props @dependabot, @Sidsector9, @faisal-alvi via #227, #230, #234).

2.2.6 – 2024-08-28

Modification : Mise à jour de WordPress « testé jusqu’à » la version 6.6 (crédits @sudip-md, @ankitguptaindia, @jeffpaul via #212, #213).
Changed: Bump WordPress minimum from 5.7 to 6.4 (props @sudip-md, @ankitguptaindia, @jeffpaul via #212, #213).
Security: Add svg sanitization on the wp_handle_sideload_prefilter filter (props @dkotter, @xknown, @iamdharmesh via GHSA-3vr7-86pg-hf4g).
Security: Bump braces from 3.0.2 to 3.0.3, pac-resolver from 7.0.0 to 7.0.1, socks from 2.7.1 to 2.8.3, ws from 7.5.9 to 7.5.10 and remove ip (props @dependabot, @Sidsector9 via #206).
Security: Bump axios from 1.6.7 to 1.7.4 (props @dependabot, @faisal-alvi via #218).

Voir le détail de l’historique du journal des modifications ici.

Great plugin, updated!

Very helpful plugin

Works Well

Nice And Easy

Good plugin, but missing …

Wonderful + fetaure request

Description

Fonctionnalités actuelles

Technical: Upload Path Security

Blocs

Installation

FAQ

Pouvons-nous modifier les attributs et les balises autorisés ?

Can my theme style an inline SVG?

Why doesn’t Safe SVG globally enable SVG uploads?

Where do I report security bugs found in this plugin?

Avis

Contributeurs/contributrices & développeurs/développeuses

Le développement vous intéresse ?

Journal des modifications

2.5.0 – 2026-09-07

2.4.0 – 2025-09-22

2.3.3 – 2025-08-13

2.3.2 – 2025-07-21

2.3.1 – 2024-12-05

2.3.0 – 2024-11-25

2.2.6 – 2024-08-28

Extension de la communauté

Méta

Évaluations

Contributeurs

Support