/ Plugin Category

/ Security & Privacy

/ Security Scanning & Malware Protection

/ Safe SVG

Safe SVG

By 10up

Security & Privacy / Security Scanning & Malware Protection

Reviewed by Omar Dabbas

Trusted WordPress expert with 20+ years of experience evaluating plugins for the WP ecosystem.

Safe SVG Review - In-Depth Analysis

Safe SVG allows you to upload SVG files while ensuring they are sanitized to prevent vulnerabilities. It also provides previews in the media library.

Performance Overview

WPS Score

7.32/10

User Rating

4.9/5 (based on 79+ reviews)

Active Installations

1,000,000+

Update Frequency

Average It is calculated using the weighted average of same category plugins.

Security Score

5.1 / 10 (Medium Risk) It is calculated using the weighted average of all versions.

What It Does

Safe SVG is the best way to allow SVG uploads in WordPress. It gives you the ability to allow SVG uploads whilst making sure that they are sanitized to stop SVG/XML vulnerabilities affecting your site. It also gives you the ability to preview your uploaded SVGs in the media library in all views.

Current features include sanitised SVGs to prevent security holes, SVGO optimisation to save space, and the ability to restrict SVG uploads to certain users. This plugin ensures that your WordPress site remains secure while enabling the use of SVG files.

Comparing to Alternatives

Safe SVG occupies a fairly unique niche by combining SVG upload support with sanitisation, and there's no widely-used direct competitor offering the exact same scope. As such, this review focuses on how well it performs on its own merits rather than against rivals.

Top alternatives

Strengths

Enables safe SVG uploads in WordPress, filling a gap in default core functionality
Actively maintained with a strong track record of patching sanitisation issues
Very high user satisfaction, with nearly 90% of reviewers giving 5 stars
Lightweight and simple to set up with minimal configuration needed

Weaknesses

No premium tier, so feature requests rely entirely on the developer's roadmap
Some gaps in coverage, such as taxonomy image uploads, remain unresolved
History of security vulnerabilities requiring users to stay vigilant about updates

User Sentiment Analysis

With a 4.9/5 average from 79 ratings and only one negative review (1.3%), sentiment toward Safe SVG is overwhelmingly positive. The vast majority of users praise its simplicity and reliability, though a small number have run into edge-case issues.

Positive highlights

"Must use plugin, well maintained, installing almost every time" — Karolina Vyskocilova
"Very helpful plugin, thanks!" — jeeni
"Needed SVG upload support, and this plugin did the job. Very lightweight and easy to use." — devlin1
"Thanks to the plugin developers. The plugin helped me solve my issue." — bandgamin
"Great plugin! very usefull..." — Stefano

Common complaints

One user reported the plugin caused significant homepage loading delays (up to 30 seconds) when used alongside WPML, with performance returning to normal after removal

Weaknesses

Past vulnerabilities include a high-severity Denial of Service issue and multiple SVG sanitisation bypasses
Security patches have been necessary multiple times over the plugin's history, meaning outdated versions pose real risk
Occasional compatibility friction with other plugins, as seen in the WPML-related complaint

Who Should Use This?

Best for

Safe SVG is ideal for WordPress site owners and developers who need to safely enable SVG uploads without building custom sanitisation logic. It suits those who want a lightweight, no-frills solution and are comfortable keeping plugins updated promptly.

Not ideal for

Given its history of medium and high-severity vulnerabilities, users who cannot commit to regular updates, or who run sensitive multisite/multilingual setups (as suggested by the WPML compatibility complaint), should proceed cautiously and test thoroughly before relying on it in production.

Pricing & Value

Free version includes

The free version provides full functionality: safe SVG upload support, sanitisation to strip malicious code, and compatibility with the standard WordPress media library, at no cost.

Final Verdict

Safe SVG earns its strong reputation through simplicity and effectiveness, letting users safely upload SVG files without extra configuration. The overwhelmingly positive reviews, near-perfect rating, and lack of direct competitors reinforce its position as a go-to solution for this specific need.

That said, its history of four known vulnerabilities—including a high-severity DoS issue and repeated sanitisation bypasses—means users must stay diligent about updates. With no premium tier to worry about and a low barrier to entry, Safe SVG is a solid choice for most sites, provided it's kept current and tested against your specific plugin stack.

Other Notable Features

Here are a few other notable features of this free Safe SVG plugin.

SVG uploads

SVG sanitization

media library

FAQ

Yes, this can be done using the svg_allowed_attributes and svg_allowed_tags filters.
They take one argument that must be returned. See below for examples:

add_filter( 'svg_allowed_attributes', function ( $attributes ) {      // Do what you want here...      // This should return an array so add your attributes to     // to the $attributes array before returning it. E.G.      $attributes[] = 'target'; // This would allow the target="" attribute.      return $attributes; } );   add_filter( 'svg_allowed_tags', function ( $tags ) {      // Do what you want here...      // This should return an array so add your tags to     // to the $tags array before returning it. E.G.      $tags[] = 'use'; // This would allow the <use> element.      return $tags; } );

Mostly, yes. The Inline SVG block renders an SVG that carries its own <style> element inside a shadow root, because CSS inside an inline SVG is otherwise applied to the whole page rather than just the SVG. Stylesheets cannot reach into a shadow root, so theme CSS such as .entry-content svg { fill: red; } will not apply to those SVGs.

Inherited properties still cross the boundary, so setting color on an ancestor and using currentColor inside the SVG works, as do CSS custom properties. SVGs that do not contain a <style> element are rendered without the shadow root and can be styled by theme stylesheets.

To turn isolation off, at the cost of allowing an SVG’s CSS to affect the rest of the page:

add_filter( 'safe_svg_inline_use_shadow_dom', '__return_false' );

Contributors and developers

“Safe SVG” is open source software. The following people have contributed to this plugin.

10up

Daryll Doyle

Jeffrey Paul

Free Version Docs

WPS

7.32

Very Good

Ratings

4.9 out of 5 | 79

Version

2.5.1

Last updated

3 weeks ago

Active installations

1,000,000+

WordPress version

7.1.3 or higher

PHP version

7.4 or higher

Languages

Other plugins you might like

Wordfence Security – Firewall, Malware Scan, and Login Security

By Mark Maunder

WPS

7.87

Very Good

4.7/5

5k+reviews

5M+

active installation

Tested with

7.1.3

Really Simple Security – Simple and Performant Security (formerly Really Simple SSL)

By Really Simple Plugins

WPS

7.7

Very Good

4.9/5

8.9k+reviews

3M+

active installation

Tested with

7.1.3

Jetpack – WP Security, Backup, Speed, & Growth

By Automattic

WPS

7.67

Very Good

3.7/5

2.4k+reviews

3M+

active installation

Tested with

7.1.3

WPS Hide Login

By Remy Perona

WPS

7.56

Very Good

4.8/5

2.1k+reviews

2M+

active installation

Tested with

7.1.3

Limit Login Attempts Reloaded – Login Security, Brute Force Protection, Firewall

By WPChef

WPS

7.5

Very Good

4.8/5

1.5k+reviews

1M+

active installation

Tested with

7.1.3

Duplicator – Backups & Migration Plugin – Cloud Backups, Scheduled Backups, & More

By Syed Balkhi

WPS

7.6

Very Good

4.9/5

4.9k+reviews

1M+

active installation

Tested with

7.1.3

Safe SVG Review - In-Depth Analysis

Performance Overview

What It Does

Comparing to Alternatives

User Sentiment Analysis

Who Should Use This?

Pricing & Value

Final Verdict

Other Notable Features

FAQ

Contributors and developers

Ratings

Reviews (79)

Sort by:

Contributors & Developers

Interested in development?

Changelog

Security Status

Secure

No Unpatched Vulnerabilities

Known Vulnerabilities (5)

Previous Versions

WPS

7.32

Other plugins you might like

Wordfence Security – Firewall, Malware Scan, and Login Security

Really Simple Security – Simple and Performant Security (formerly Really Simple SSL)

Jetpack – WP Security, Backup, Speed, & Growth

WPS Hide Login

Limit Login Attempts Reloaded – Login Security, Brute Force Protection, Firewall

Duplicator – Backups & Migration Plugin – Cloud Backups, Scheduled Backups, & More