Why WordPress Restricts SVG Uploads by Default

Scalable Vector Graphics (SVGs) are widely used for web graphics due to their infinite scalability and minimal file sizes, yet default WordPress installations block users from uploading them to the Media Library. This article explains why WordPress disables native SVG support, focusing on the underlying security risks associated with XML-based files—specifically Cross-Site Scripting (XSS) and XML External Entity (XXE) attacks—and why administrative plugins or sanitization tools are required to enable them safely.

SVGs Are XML Documents, Not Raster Images

Standard image formats like JPEG, PNG, or WebP consist of binary data representing pixels. In contrast, an SVG is an XML-based text document that describes vector graphics using code. Because SVG is essentially code, it supports standard web technologies such as CSS, HTML, and embedded JavaScript.

When a browser renders an SVG, it executes the code within the file. This creates an open pathway for malicious actors to hide executable code inside an apparently harmless graphic.

Primary Security Vulnerabilities

The default restriction in WordPress exists primarily to protect websites from two major threats:

1. Cross-Site Scripting (XSS): An attacker can embed a <script> tag inside an SVG file. If an administrator or site visitor views the raw SVG file, the script executes within the context of the website’s domain. This can lead to stolen session cookies, unauthorized administrative actions, or total site takeover.
2. XML External Entity (XXE) Attacks and Billion Laughs: Vulnerable XML parsers on the hosting server can be exploited via malicious XML declarations. This can allow attackers to read local server files, interact with internal networks, or launch Denial of Service (DoS) attacks by overwhelming server memory.

The WordPress Security Stance

WordPress allows multiple user roles—such as Authors, Contributors, and Editors—to upload media files. If SVG uploads were enabled by default, any compromised account with upload privileges could upload an infected file and compromise the entire server or its visitors.

PHP does not include a standardized, secure, native XML sanitizer in its core distribution. Because WordPress core developers prioritize backward compatibility and universal security across diverse hosting environments, they chose to disallow SVG uploads entirely rather than rely on incomplete or host-dependent parsing methods.

Why Plugins Are Required

Administrative plugins allow site owners to safely override this restriction. These plugins implement specialized sanitization libraries (such as DOMPurify or SVG-Sanitizer) that scan the SVG file upon upload, strip out unauthorized XML tags, remove JavaScript, and eliminate external entity references. By using a plugin, administrators take deliberate responsibility for sanitizing vector files and restricting upload capabilities to trusted user roles.