Safe SVG
by 10up
Allows SVG uploads while sanitising each file, so vector logos and icons cannot carry scripts.
This link may earn us a commission. It never changes our rating.
What Safe SVG does
Allows SVG uploads while sanitising each file, so vector logos and icons cannot carry scripts.
It sits in the media part of a WordPress stack and is sold by 10up on a free basis. We recommend it in our media guides because it does that one job well without asking you to rebuild the rest of the site around it.
Every plugin adds work to a page request, so treat this as a decision with a cost. Record a speed test before you install it and run the same test afterwards, on the same page, so you know exactly what it charged you.
Real user ratings
Score
4.9/5
Reviews
79
Active installs
1,000,000+
Downloads
13.6M
Latest version
2.5.0
Last updated
2026-09-06
These figures come straight from the public WordPress.org plugin directory API for version 2.5.0, not from us. Check them yourself on the WordPress.org listing. Our own editorial score is 4.9/5.
Where Safe SVG ranks elsewhere
Safe SVG does not appear in the published "best of" lists we track from WPBeginner, TechRadar, Kinsta, Themeisle and similar sites. That is not a mark against it - those roundups are short and skew towards the biggest names.
What changed in the latest version
- Security: Prevented direct access of PHP files (props @mehrazmorshed , @dkotter via #300 ).
- Security: The Inline SVG block now renders SVGs that carry their own <style> element inside a shadow root, so their CSS is scoped to the block instead of applying to the whole page (props @darylldoyle , @dkotter , @jeffpaul , @peterwilso...
- Security: Bump enshrined/svg-sanitize from ^0.22.0 to ^1.0.0 to pull in security fixes (props @dkotter , @jeffpaul , @peterwilsoncc via #327 ).
- Added: Link support for the SVG Inline block, including URL input, new tab toggle, and nofollow/sponsored rel options (props @vegetable-bits , @mgiannopoulos24 , @jeffpaul , @thrijith , @peterwilsoncc , @dkotter , @pbiron via #315 ).
- Added: New safe_svg_inline_use_shadow_dom filter to control which inline SVGs are isolated in a shadow root, and new safe_svg_inline_shadow_styles filter to adjust the CSS injected alongside them (props @darylldoyle , @dkotter , @jeffpau...
- Added: New safe_svg_remove_remote_references filter to strip remote url() , @import and image-set() references, along with remote href targets, from uploaded SVGs. Off by default, because legitimate SVGs reference remote fonts and images...
- Added: Added support for Enable Media Replace plugin (props @gthayer , @jeffpaul , @peterwilsoncc via #285 ).
- Changed: Bump WordPress minimum supported version to 6.9 (props @zamanq , @peterwilsoncc via #320 ).
- Added: Ability to upload SVGs from more admin locations (props @stormrockwell , @darylldoyle , @wpexplorer , @smerriman , @jeffpaul , @dkotter via #279 ).
- Changed: Added $attachment_id argument to filters safe_svg_use_width_height_attributes and safe_svg_dimensions (props @roborourke , @dkotter via #278 ).
- Fixed: Inconsistent or incorrect data type for $svg argument in the filters safe_svg_use_width_height_attributes and safe_svg_dimensions (props @roborourke , @dkotter via #278 ).
- Security: Update the enshrined/svg-sanitize package from 0.19.0 to 0.22.0 to fix an issue with case-insensitive attributes slipping through the sanitiser and address PHP 8.4 deprecation warnings (props @darylldoyle , @sudar , @georgestep...
- Security: Bump form-data from 4.0.0 to 4.0.4 (props @dependabot , @faisal-alvi via #270 ).
- Security: Bump tmp from 0.2.3 to 0.2.5 and @inquirer/editor from 4.2.9 to 4.2.16 (props @dependabot , @dkotter via #271 ).
Release notes are the developer's own words, published on WordPress.org. Read the full changelog
Pros and cons
- SVG uploads without the usual security hole
- Free with no licence to renew
- Actively maintained and used on production sites we test
- Only trusted roles should still be allowed to upload
- Support is community-led rather than guaranteed
How to use it
- 1Install on a staging copy first if the site takes money.
- 2Work through the setup wizard and connect any external accounts it needs.
- 3Configure the one feature you installed it for, and leave the rest off.
- 4Test the result as a logged-out visitor on both mobile and desktop.
- 5Re-run our speed test to confirm the plugin has not cost you load time.
How it compares
Other media plugins we recommend, with their rating and pricing model.
| Plugin | Our rating | WordPress.org | Pricing | Best for |
|---|---|---|---|---|
| Safe SVG | 4.9 | 4.9 (79) | Free | SVG uploads without the usual security hole |
| Enable Media Replace | 4.4 | 4.4 (302) | Freemium | Swap a file without hunting down every link |