Limited-Time Offer

Get Extra 20% off on FullCharge Yearly Plan — available for first 10 users only. Don’t miss out! 🚀

TrackWP

SVG Support · Version history

SVG Support changelog and version history

Latest version
2.6.3
Oct 31, 2026 (8 days ago)
Releases
65
since 2014
In the last year
13
about one every 13 days
Tested up to
WordPress 7.1.4
PHP 7.4 or later

Releases each year

  • 201410 releases
  • 20153 releases
  • 20162 releases
  • 201715 releases
  • 20183 releases
  • 20191 release
  • 20203 releases
  • 202211 releases
  • 20244 releases
  • 202613 releases

202613 releases

  1. SVG Support 2.6.3Latest

    • Security Enhancements:
    • Updated the bundled SVG sanitizer (enshrined/svg-sanitize) to 1.1.1. On PHP 8, version 1.1.0 threw an error instead of rejecting an SVG that ends inside an unclosed tag (GHSA-f7cw-vfxq-7ph2). For an SVG stored through wp_upload_bits(), as the WordPress Importer and some other plugins do, that left…
    • Hardening: if the sanitizer ever fails with an error, the SVG is treated as one that can’t be sanitized and is rejected, instead of the error ending the request
    • Fixed:
    • SVGs on offloaded media (such as S3 Uploads, which stores files at s3:// paths) now get their real width and height in the Media Library and in their attachment metadata, instead of 0×0. Those paths were mistaken for web addresses and downloaded over HTTP, which WordPress refuses, instead of being…
    • New Features:
    • New bodhi_svgs_remote_svg_url filter for the URL a remote SVG is downloaded from to read its dimensions, for example to sign URLs for a private bucket. Props to @dylanblokhuis on GitHub for the suggestion

  2. SVG Support 2.6.2

    • Security Enhancements:
    • Fixed a stored XSS where SVGs uploaded over XML-RPC (wp.uploadFile and metaWeblog.newMediaObject, including .svgz) skipped sanitization. XML-RPC uploads are now sanitized before they are written, and any SVG stored through wp_upload_bits() (importers and other plugins) is sanitized once it lands on…
    • Fixed a stored XSS in Safari where an SVG animation such as <animateTransform> could turn a link’s target into a javascript: URL after sanitization. Animations can no longer target a link or an event handler, and script URLs are removed from animated values. Exploiting it required a user who had be…
    • Hardening: uploads from users without the upload_files capability (for example through a front-end upload form) are now always sanitized. “Do not sanitize for these roles” only applies to users who can upload files
    • Updated the bundled SVG sanitizer (enshrined/svg-sanitize) to 1.1.0, which fixes seven upstream security advisories (remote references, DTD entities, SMIL animations and several slow-input cases)
    • Updated the bundled DOMPurify library to 3.4.17 for front-end sanitization of inline SVGs. The 2.x line no longer receives security fixes
    • Behavior Changes (from the sanitizer update):
    • Remote references are removed more thoroughly: a remote <image>, or a remote CSS url() or @import (such as a Google Fonts import) inside an SVG, is now stripped. Links (<a href="https://...">) are kept
    • SVGs that define their own DTD entities are now rejected by every upload route. The Media Library already refused them
    • Fixed:
    • No more finfo_close() deprecation notice on every SVG upload under PHP 8.5
    • Gzipped .svgz files now get their width and height read, instead of 0×0 and a PHP warning
    • Compatibility:
    • Tested up to WordPress 7.1. No code changes were required — WordPress 7.1’s new client-side media processing only handles raster images (JPEG, PNG, GIF, WebP and AVIF), so SVG uploads keep running through this plugin’s own MIME validation and sanitization exactly as before.
    • New Features:
    • Optional SVG Support Pro waitlist sign-up on the settings screen — join for launch news, early access and founding-supporter pricing. Your email address is sent only when you submit that form (see External Services above), and the free plugin stays free, like always.

  3. SVG Support 2.6.1

    • Fixed:
    • Fatal error when uploading SVGs through WP-CLI (wp media import, migration and hosting tooling) — the sanitizer instance never reached global scope in CLI contexts. No security impact: affected uploads crashed rather than skipping sanitization (failed closed). The sanitizer is now resolved through…

  4. SVG Support 2.6.0

    • New Features:
    • Completely redesigned settings screen with the new SVG Support brand — cleaner panels, real toggle switches, role picker chips, and a live code sample
    • Settings now auto-save as you change them, with a save-state indicator (the classic Save button remains as a no-JS fallback)
    • Advanced Mode now reveals its options instantly when toggled — no more save-and-reload
    • Scannable QR codes for the BTC and ETH donation addresses (tap the QR icon next to each address)
    • New brand site at https://svg.support with tutorials and documentation
    • Code Improvements:
    • Removed the third-party jQuery dropdown multiselect (~1,000 lines) — role pickers are now dependency-free native checkboxes
    • Fixed admin/front-end asset cache-busting: enqueued styles/scripts are now versioned with the plugin version (previously the version was empty, so browser caches never refreshed on update)
    • Settings screen assets (fonts, icons, styles, JS) only load on the SVG Support settings page
    • Removed the CodeKit build dependency — stylesheets are now plain CSS edited directly, and minified JS is regenerated with a simple in-repo script

  5. SVG Support 2.5.16

    • General Updates:
    • Updated the author social link from Warpcast to Farcaster (farcaster.xyz/benbodhi)
    • Removed the source map reference from the bundled DOMPurify library to stop browsers requesting a missing .map file (harmless 404 in dev tools)

  6. SVG Support 2.5.17

    • Security Enhancements:
    • Fixed a stored XSS sanitization bypass via the .svgz extension – .svgz uploads are now sanitized just like .svg (decompressing the gzip stream first when present), instead of skipping sanitization. This completes the earlier fixes for CVE-2024-10222 / CVE-2023-6708. Thanks to Shivamani Vastrala for…
    • Browser uploads now run through the same sanitizer configuration as REST and import uploads (custom tag/attribute allow-lists and remote reference removal), keeping all upload paths consistent
    • Added direct file access protection to the settings page so it can no longer be loaded outside of WordPress
    • Code Improvements:
    • Renamed the internal final_output filter to bodhi_svgs_thumbs_final_output so it’s properly prefixed and can’t clash with other plugins
    • Removed the redundant load_plugin_textdomain() call – WordPress automatically loads translations for plugins hosted on WordPress.org
    • Documented the intentional direct database queries used for plugin meta cleanup (no functional change)

  7. SVG Support 2.5.15

    • Security Enhancements:
    • Fixed a broken access control issue in the inline featured image toggle (CVE-2026-48973) – the AJAX action is no longer exposed to logged-out visitors and now checks edit permissions on the specific post
    • SVGs added programmatically via media_handle_sideload() are now sanitized, just like regular media library uploads
    • Updated the bundled SVG sanitizer (enshrined/svg-sanitize) to 0.22.0, which patches an XSS bypass in xlink:href handling
    • Fixes:
    • SVG uploads work again on WordPress 6.8 and newer – opted out of the new check that was blocking SVGs because the server can’t generate responsive image sizes for them
    • General Updates:
    • Tested and confirmed working with WordPress 7.0
    • Updated the bundled DOMPurify library to 2.5.9

  8. SVG Support 2.5.14

    • Security Enhancements:
    • Remove default roles from the sanitizer bypass settings
    • Fixes:
    • More comprehensive upload checks, allowing generator tags and comment patterns
    • Performance Improvements:
    • Cleanup duplicate inline_featured_image meta entries more efficiently
    • Remove inline_featured_image meta entries that aren’t explicitly set to 1 (enabled)
    • Don’t store inline_featured_image meta for posts that previously had it enabled but don’t anymore
    • General Updates:
    • Restructured settings layout
    • Better cleanup on uninstall when delete plugin data is selected

  9. SVG Support 2.5.13

    • Code Improvements:
    • Better PHP 8.3 compatibility – added null checks to prevent deprecated warnings in PHP 8.3

  10. SVG Support 2.5.12

    • General Updates:
    • Added blueprint.json for the live preview feature on wordpress.org
    • Fixes:
    • Fixed mime type check that was restricting SVG uploads without the XML tag in PHP 7.4

  11. SVG Support 2.5.11

    • Security Enhancement
    • Added more effective handling of sanitization for REST API uploads

  12. SVG Support 2.5.10

    • Fixes:
    • Fixed issue with upload checks preventing plugin uploads

  13. SVG Support 2.5.9

    • New Features:
    • Added new Advanced Mode setting “Skip Nested SVGs” to control inlining of SVGs within containers (for example: nested SVGs in Gutenberg Cover blocks)
    • Added proper multisite support for SVG uploads across subsites
    • Added network administrator support for SVG uploads on all subsites
    • Security Enhancements:
    • Updated DOMPurify library to version 2.5.8
    • Updated enshrined/svg-sanitize to version 0.21.0
    • Added nonce verification for non-REST uploads to prevent CSRF attacks
    • Improved MIME type validation for SVG files
    • Enhanced file content validation to ensure only valid SVG files are processed
    • Moved security checks earlier in the upload process for better efficiency
    • Updated and improved sanitization options for both frontend and admin
    • Code Improvements:
    • Changed synchronous XMLHttpRequest to asynchronous in vanilla JS version to improve performance and remove Chrome deprecation warnings
    • Removed console logging statements from JavaScript files for cleaner browser console
    • Reorganized upload validation flow for better performance
    • Added proper error messages for failed security checks
    • Improved handling of REST API uploads
    • Enhanced code documentation and inline comments
    • Added proper plugin asset handling and alt text for admin images
    • Enhanced multisite compatibility with proper role and capability checks
    • Added network-level upload permission validation
    • Added AJAX hooks for featured image inline toggle
    • Enqueue minified Gutenberg filters script instead of expanded version
    • Added better version update handling
    • Fixes:
    • PHP Warning about undefined array key “css_target” in admin init.php
    • Fixed “not allowed to upload this file type” error on multisite installations
    • Fixed duplicate meta entries for inline featured images preventing post saves
    • Added automatic cleanup of duplicate meta entries during plugin update

20244 releases

  1. SVG Support 2.5.8

    • Security Enhancements:
    • Improved sanitization of SVG uploads and attachments for enhanced security.
    • Ensured all output in the admin settings page is properly escaped.
    • Replaced direct file handling functions with WordPress APIs for better security and compatibility.
    • Improved translation support with added translators’ comments and ordered placeholders.
    • Admin Interface Improvements:
    • Updated admin-init.php with better escaping practices and enhanced security for the settings page.
    • Added error logging to SVG processing to assist with debugging without disrupting the user experience.
    • Performance and Compatibility:
    • Updated enqueue functions to ensure scripts and styles are loaded efficiently with proper dependencies.
    • Improved metadata handling for SVGs to prevent issues in the Media Library and with ACF integration.
    • Optimized nonce verification and meta updates in the featured image functions to prevent unnecessary database writes.
    • General Code Improvements:
    • Refactored code to reduce redundancy and improve maintainability.
    • Added detailed inline documentation for better code clarity and future development.
    • Experimental Integration with WP All Import:
    • Introduced integration with WP All Import for experimental SVG handling during imports.
    • SVG files imported via WP All Import are sanitized, and their metadata is generated and updated correctly.
    • Added error logging to track issues during SVG import processing.
    • Note: This feature is experimental and commented out in the main plugin file for now. Feel free to uncomment the include lines to test it out, but please ensure you back up your data first.

  2. SVG Support 2.5.7

    • Compatibility with newer versions of php.

  3. SVG Support 2.5.6

    • Addressed some security concerns.

  4. SVG Support 2.5.5

    • More error fixes and general clean up.

202211 releases

  1. SVG Support 2.5.4

    • Fixed errors.

  2. SVG Support 2.5.3

    • Fixed fatal php error.

  3. SVG Support 2.5.2

    • Added some defaults for better security by default.

  4. SVG Support 2.5.1

    • Added missing quotes in uninstall.php.

  5. SVG Support 2.5

    • Cleaned up spelling mistakes and general formatting.
    • Addressed security concern.
    • Added more sanitization options – frontend and admin both supported.
    • Added support for SVG minification.
    • Added ability to choose jQuery or vanilla JS.
    • Added DB cleanup on uninstall.
    • Fixed dimensions fallback.

  6. SVG Support 2.4.2

    • Fixed srcset warning for some premium themes.
    • Fixed original IMG IDs not getting preserved on replacement.
    • Removed some rogue text from featured image box.

  7. SVG Support 2.4.1

    • Fixed issue causing WP-CLI to break.

  8. SVG Support 2.4

    • NEW FEATURE: Added optional SVG sanitization.
    • NEW FEATURE: Added optional SVG minification.
    • Added inline SVG checkbox to Gutenberg featured image.
    • Better Gutenberg support in general.
    • Modified class targeting to allow inline rendering of nested SVGs (any level deep) when you can’t set the IMG class directly.
    • Modified JS to use vanilla JS instead of jQuery.
    • Fixed accessibility issues on settings page.
    • Fixed dimensions metadata issue.
    • Fixed division by 0 issue when SVG had no width or height set.
    • Fixed featured image spacing issue in both classic and block editor.
    • Bumped required PHP version.
    • Removed obsolete admin notice.
    • Removed srcset for SVG files.
    • Removed directory name from filepath metadata.

  9. SVG Support 2.3.21

  10. SVG Support 2.3.20

  11. SVG Support 2.3.19

20203 releases

  1. SVG Support 2.3.18

  2. SVG Support 2.3.17

  3. SVG Support 2.3.16

20191 release

  1. SVG Support 2.3.15

20183 releases

  1. SVG Support 2.3.14

  2. SVG Support 2.3.13

  3. SVG Support 2.3.12

201715 releases

  1. SVG Support 2.3.11

  2. SVG Support 2.3.10

  3. SVG Support 2.3.9

  4. SVG Support 2.3.8

  5. SVG Support 2.3.7

  6. SVG Support 2.3.6

  7. SVG Support 2.3.5

  8. SVG Support 2.3.4

  9. SVG Support 2.3.3

  10. SVG Support 2.3.2

  11. SVG Support 2.3.1

  12. SVG Support 2.3

  13. SVG Support 2.2.5

  14. SVG Support 2.2.4

  15. SVG Support 2.2.3.2

20162 releases

  1. SVG Support 2.2.3.1

  2. SVG Support 2.2.3

20153 releases

  1. SVG Support 2.2.2

  2. SVG Support 2.2.1

  3. SVG Support 2.2

201410 releases

  1. SVG Support 2.1.7

  2. SVG Support 2.1.6

  3. SVG Support 2.1.5

  4. SVG Support 2.1.4

  5. SVG Support 2.1.3

  6. SVG Support 2.1.2

  7. SVG Support 2.1.1

  8. SVG Support 2.1

  9. SVG Support 2.0

  10. SVG Support 1.0

Questions about SVG Support’s releases

What is the latest version of SVG Support?

2.6.3, released on Oct 31, 2026 (1 week ago). It’s tested up to WordPress 7.1.4 and needs PHP 7.4 or later.

How often is SVG Support updated?

13 releases in the last year, about one every 13 days. Its first release on WordPress.org dates from July 2014.

Know when your rivals ship

Track your plugin and its rivals: TrackWP sees each new release in the nightly snapshot and alerts you, with what it did to their rank.

Start free

Release dates come from the day each version’s folder was made in SVG Support’s WordPress.org SVN repository; the notes from its readme’s changelog, as its authors wrote it.