SVG sanitization covers standard WordPress upload paths
Safe SVG sanitizes SVGs on common WordPress upload and sideload routes, but not every route a site may use.
It hooks into standard upload actions to sanitize files before they are accepted. WordPress also allows plugins and themes to create custom upload actions, which Safe SVG cannot cover in advance.
The plugin does not globally enable SVG uploads because doing so could allow SVGs through paths that bypass sanitization. Sites using custom upload routes should check whether those routes sanitize SVGs; otherwise, unsafe files could reach the site.
Media previews, upload permissions and SVG handling options
Safe SVG adds practical media-library controls, with several behaviors managed through filters.
- Media Library previews: SVGs appear in all Media Library views, helping users identify files before selecting them.
- Upload permissions: Choose which users can upload SVGs, or allow uploads from anyone; restrict access if SVG uploads should be limited to trusted users.
- SVGO optimization: Optimization is off by default and can be enabled with the
safe_svg_optimizer_enabled filter.
- Allowed tags and attributes: The
svg_allowed_tags and svg_allowed_attributes filters let developers adjust which SVG elements and attributes are permitted.
- Inline SVG styling: SVGs containing their own `` element use a shadow root to isolate those styles from the page. Inherited properties and CSS custom properties still work, but theme stylesheets cannot reach into the shadow root. The
safe_svg_inline_use_shadow_dom filter disables isolation, with the trade-off that SVG styles may affect the rest of the page.
A widely adopted plugin with an important upload-path caveat
Safe SVG is a strong fit for sites that need SVG uploads and clear previews in the Media Library, especially when uploads follow standard WordPress routes.
Its adoption is among the highest in the directory, its rating is excellent across a moderate number of reviews, and it was updated within the last week. There are no open support threads. The main trade-off is coverage: sites with custom upload actions should verify those paths are secured before relying on SVG uploads.
