Focused WordPress plugins for real client work.Clear licensing for 1, 5, or 100 websites
Dprime Plugins
Browse plugins

Safe SVG documentation

Help and reference for version 1.4.1.

Overview

Dprime Safe SVG allows SVG and SVGZ uploads to the WordPress Media Library and automatically sanitizes every file to prevent XML and SVG based vulnerabilities.

**Features**

Requirements

  • WordPress 6.4 or newer
  • PHP 8.2 or newer

Installation

  1. Upload the plugin folder to /wp-content/plugins/.
  2. Activate Dprime Safe SVG through the Plugins screen.
  3. Visit the Safe SVG admin page from the Dprime menu (or its own top level menu) to configure roles.

Using the plugin

  • Allows SVG and SVGZ uploads to the Media Library
  • Sanitizes every file on upload to remove dangerous elements and attributes
  • Per role upload control. Pick which roles can upload SVG files
  • Correct previews and dimensions for SVG attachments in the Media Library
  • Safe SVG block in the editor for inlining SVG markup into pages
  • Backed by the well known enshrined/svg-sanitize library

Data and cleanup

  • 8 WordPress settings
  • Uploaded files: {{uploads}}/dprime-safe-svg

Retention: kept until the plugin is uninstalled. Uninstall policy: delete the plugin-owned data declared above.

Frequently asked questions

Which roles can upload SVG files by default?

Any role that already has the standard upload_files capability can upload SVG files. Open the Safe SVG admin page and tick specific roles to restrict that.

Is this safe?

Every SVG file is run through the enshrined/svg-sanitize library on upload. Anything outside the allowlist of safe SVG tags and attributes is stripped before the file is written to disk.

I had the old Safe SVG plugin installed. Do I lose my settings?

No. The role list, large file toggle, and capability name are stored under the same option keys as the original plugin, so the upgrade is a no op for your data.

Does this plugin work with Dprime Core?

Yes. With Dprime Core installed and active, the Safe SVG admin page appears under the Dprime parent menu. Without Core, the plugin runs standalone with its own top level menu.

Updates and access

This complete free release can be downloaded directly. Install Dprime Core for automatic catalogue updates.