Found your question as I was searching for an answer. I tried experimenting a bit more with wp_kses and found that lower-casing viewbox in the arguments seems to fix the issue. You don’t have to put the actual attribute on the SVG in lowercase, just the wp_kses() argument. This may be more than you need, … Read more
[*] Unfortunately the colon is a TinyMCE control character Forces the attribute to the specified value. For example, ‘border:0’ …hence the switch to xlink=href. The only apparent solution is the wildcard use[*] Use the control character ? which “separates attribute verification values” i.e. use[xlink?href] [*]
Per the thread below, a temporary solution would be to add this code to your wp-config file: define( ‘ALLOW_UNFILTERED_UPLOADS’, true ); https://wordpress.org/support/topic/wp-4-7-1-kills-svg/page/3/
This article has a bunch of great answers to your questions. I highly recommend checking it out to learn more about the scale of this issue, but I can give a quick rundown. SVG, since it’s XML based, makes it really hard to decipher what is and what isn’t malicious. At one end, it opens … Read more
WordPress has trouble with the width and height attributes for SVGs. The width and height attributes can be removed for SVGs using this code adapted from trac ticket #26256 . /** * Removes the width and height attributes of <img> tags for SVG * * Without this filter, the width and height are set to … Read more
I solved it!!! The filter in fix #3 (above) wasn’t working because of the third condition of this if statement that triggers the dimension extraction and attachment: if (is_array($image) && preg_match(‘/\.svg$/i’, $image[0]) && $image[1] == 1) $image[1] in the third condition is the reported width of the SVG file as WP sees it before it … Read more
This question had me scratching my head. Yeah, how come WordPress doesn’t support this natively? And then I found out. You asked how to upload SVG in WordPress 4.9.8 (the current version at the time of writing). You mention that you “tried uploading after installing different plugins”. You don’t say which plugins, nor whether they … Read more
Here is a PHP library that was created for sanitizing SVG files that may be worth looking into. https://github.com/darylldoyle/svg-sanitizer Here is an example of how this could be used: // Now do what you want with your clean SVG/XML data function your_save_meta( $post_id, $post, $update ) { // – Update the post’s metadata. if ( … Read more
Take a look at wp_prepare_attachment_for_js(), which is what gathers attachment metadata for use on the Media pages. The eponymous filter lets us add or alter metadata. The following example can be dropped into functions.php. Note: this requires SimpleXML support in PHP. function common_svg_media_thumbnails($response, $attachment, $meta){ if($response[‘type’] === ‘image’ && $response[‘subtype’] === ‘svg+xml’ && class_exists(‘SimpleXMLElement’)) { … Read more
SVG can contain JavaScript. JavaScript can be used to hijack cookies or do other questionable actions. It can even be “hidden” in namespaces: <html xmlns:ø=”http://www.w3.org/1999/xhtml”> <ø:script src=”https://0x.lv/” /> </html> source It is very hard to filter that out during the upload, so it is just not allowed by default.