Is CVE-2026-94077 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-94077 being exploited in the wild.

How severe is CVE-2026-94077?

Medium severity, with a CVSS score of 6.5, published 30 September 2026.

Is there a fix for CVE-2026-94077?

A patch was published on 2026-09-23: Version 2.5.1 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-94077 attacked?

It is attacked over the network, in a software library.

Am I affected by CVE-2026-94077?

Check whether you run 10up Safe SVG at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-94077: WordPress Safe SVG cross-site scripting in contributor role

CVE-2026-94077 · Severity: medium · CVSS 6.5 · Published 2026-09-30

Safe SVG is a WordPress plugin that processes and sanitizes SVG file uploads for websites. A contributor-level user can inject malicious JavaScript code that executes in the browsers of site visitors, potentially stealing their session credentials or performing unauthorized actions on their behalf.

Vendors: 10up.

Quick answers

Is CVE-2026-94077 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-94077 being exploited in the wild.
How severe is CVE-2026-94077?: Medium severity, with a CVSS score of 6.5, published 30 September 2026.
Which products and versions are affected?: 10up Safe SVG <= 2.5.0.
Is there a fix for CVE-2026-94077?: A patch was published on 2026-09-23: Version 2.5.1 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-94077 attacked?: It is attacked over the network, in a software library.
Am I affected by CVE-2026-94077?: Check whether you run 10up Safe SVG at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

The plugin contains a stored XSS vulnerability in versions up to 2.5.0 that allows authenticated users with contributor or higher privileges to inject malicious scripts through SVG file handling. Exploitation requires user interaction and elevated privileges but no network-level authentication bypass; the attack persists on the site until remediated. A patch is available in version 2.5.1.

Affected products

10up Safe SVG <= 2.5.0

Timeline

2026-09-23: disclosed
2026-09-23: patched: Version 2.5.1

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.