CVE-2026-48973

MediumCVSS 4.3

Published: 27/05/2026(UTC)Updated: 26/10/2026(UTC)Translated: 26/10/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.20%

10th percentile - higher than 10% of all known CVEs

Summary

The SVG Support plugin for WordPress contains a Missing Authorization vulnerability that allows exploiting incorrectly configured access control security levels. The issue affects versions up to and including 2.5.14.

Risk Assessment

An attacker may gain access to functions or data that should be protected, compromising the confidentiality and integrity of the site.

Recommendation

Update the SVG Support plugin to a version later than 2.5.14 and review user permissions.

Other vulnerabilities in SVG Support

CVE-2026-13340Medium
The SVG Support WordPress plugin before version 2.5.17 does not apply its SVG sanitisation to uploaded files using the .svgz extension, even though it registers and serves them as SVG. This allows a user permitted to upload SVGs (such as an Author once granted upload access) to store a script-bearing file that executes in the browser of anyone who later views it, including an administrator.

Original NVD description (English source)

Missing Authorization vulnerability in Benbodhi SVG Support allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects SVG Support: from n/a through 2.5.14.

Vulnerability data from NVD (NIST) · CISA KEV · EPSS