SVG Support

2.5.16

• General Updates:
  • Updated the author social link from Warpcast to Farcaster (farcaster.xyz/benbodhi)
  • Removed the source map reference from the bundled DOMPurify library to stop browsers requesting a missing .map file (harmless 404 in dev tools)

2.5.15

• Security Enhancements:

  • Fixed a broken access control issue in the inline featured image toggle (CVE-2026-48973) – the AJAX action is no longer exposed to logged-out visitors and now checks edit permissions on the specific post
  • SVGs added programmatically via media_handle_sideload() are now sanitized, just like regular media library uploads
  • Updated the bundled SVG sanitizer (enshrined/svg-sanitize) to 0.22.0, which patches an XSS bypass in xlink:href handling

• Fixes:

  • SVG uploads work again on WordPress 6.8 and newer – opted out of the new check that was blocking SVGs because the server can’t generate responsive image sizes for them

• General Updates:

  • Tested and confirmed working with WordPress 7.0
  • Updated the bundled DOMPurify library to 2.5.9

2.5.14

• Security Enhancements:

  • Remove default roles from the sanitizer bypass settings

• Fixes:

  • More comprehensive upload checks, allowing generator tags and comment patterns

• Performance Improvements:

  • Cleanup duplicate inline_featured_image meta entries more efficiently
  • Remove inline_featured_image meta entries that aren’t explicitly set to 1 (enabled)
  • Don’t store inline_featured_image meta for posts that previously had it enabled but don’t anymore

• General Updates:

  • Restructured settings layout
  • Better cleanup on uninstall when delete plugin data is selected

2.5.13

• Code Improvements:
  • Better PHP 8.3 compatibility – added null checks to prevent deprecated warnings in PHP 8.3

2.5.12

• General Updates:

  • Added blueprint.json for the live preview feature on wordpress.org

• Fixes:

  • Fixed mime type check that was restricting SVG uploads without the XML tag in PHP 7.4

2.5.11

• Security Enhancement
  • Added more effective handling of sanitization for REST API uploads

2.5.10

• Fixes:
  • Fixed issue with upload checks preventing plugin uploads

2.5.9

• New Features:

  • Added new Advanced Mode setting “Skip Nested SVGs” to control inlining of SVGs within containers (for example: nested SVGs in Gutenberg Cover blocks)
  • Added proper multisite support for SVG uploads across subsites
  • Added network administrator support for SVG uploads on all subsites

• Security Enhancements:

  • Updated DOMPurify library to version 2.5.8
  • Updated enshrined/svg-sanitize to version 0.21.0
  • Added nonce verification for non-REST uploads to prevent CSRF attacks
  • Improved MIME type validation for SVG files
  • Enhanced file content validation to ensure only valid SVG files are processed
  • Moved security checks earlier in the upload process for better efficiency
  • Updated and improved sanitization options for both frontend and admin

• Code Improvements:

  • Changed synchronous XMLHttpRequest to asynchronous in vanilla JS version to improve performance and remove Chrome deprecation warnings
  • Removed console logging statements from JavaScript files for cleaner browser console
  • Reorganized upload validation flow for better performance
  • Added proper error messages for failed security checks
  • Improved handling of REST API uploads
  • Enhanced code documentation and inline comments
  • Added proper plugin asset handling and alt text for admin images
  • Enhanced multisite compatibility with proper role and capability checks
  • Added network-level upload permission validation
  • Added AJAX hooks for featured image inline toggle
  • Enqueue minified Gutenberg filters script instead of expanded version
  • Added better version update handling

• Fixes:

  • PHP Warning about undefined array key “css_target” in admin init.php
  • Fixed “not allowed to upload this file type” error on multisite installations
  • Fixed duplicate meta entries for inline featured images preventing post saves
  • Added automatic cleanup of duplicate meta entries during plugin update
  • Improved handling of featured image meta to prevent duplicate entries
  • Updated and refactored Gutenberg featured image checkbox to use modern React hooks instead of deprecated withState
  • Fixed missing file path in SVG attachment metadata causing issues with WPML Media Translation
  • Fixed jQuery dependency only being required when not using vanilla JS option

• General Updates:

  • Updated security documentation
  • Refined error messaging for better user experience

2.5.8

• Security Enhancements:

  • Improved sanitization of SVG uploads and attachments for enhanced security.
  • Ensured all output in the admin settings page is properly escaped.
  • Replaced direct file handling functions with WordPress APIs for better security and compatibility.
  • Improved translation support with added translators’ comments and ordered placeholders.

• Admin Interface Improvements:

  • Updated admin-init.php with better escaping practices and enhanced security for the settings page.
  • Added error logging to SVG processing to assist with debugging without disrupting the user experience.

• Performance and Compatibility:

  • Updated enqueue functions to ensure scripts and styles are loaded efficiently with proper dependencies.
  • Improved metadata handling for SVGs to prevent issues in the Media Library and with ACF integration.
  • Optimized nonce verification and meta updates in the featured image functions to prevent unnecessary database writes.

• General Code Improvements:

  • Refactored code to reduce redundancy and improve maintainability.
  • Added detailed inline documentation for better code clarity and future development.

• Experimental Integration with WP All Import:

  • Introduced integration with WP All Import for experimental SVG handling during imports.
  • SVG files imported via WP All Import are sanitized, and their metadata is generated and updated correctly.
  • Added error logging to track issues during SVG import processing.
  • Note: This feature is experimental and commented out in the main plugin file for now. Feel free to uncomment the include lines to test it out, but please ensure you back up your data first.

2.5.7

• Compatibility with newer versions of php.

2.5.6

• Addressed some security concerns.

2.5.5

• More error fixes and general clean up.

2.5.4

• Fixed errors.

2.5.3

• Fixed fatal php error.

2.5.2

• Added some defaults for better security by default.

2.5.1

• Added missing quotes in uninstall.php.

2.5

• Cleaned up spelling mistakes and general formatting.
• Addressed security concern.
• Added more sanitization options – frontend and admin both supported.
• Added support for SVG minification.
• Added ability to choose jQuery or vanilla JS.
• Added DB cleanup on uninstall.
• Fixed dimensions fallback.

2.4.2

• Fixed srcset warning for some premium themes.
• Fixed original IMG IDs not getting preserved on replacement.
• Removed some rogue text from featured image box.

2.4.1

• Fixed issue causing WP-CLI to break.

2.4

• NEW FEATURE: Added optional SVG sanitization.
• NEW FEATURE: Added optional SVG minification.
• Added inline SVG checkbox to Gutenberg featured image.
• Better Gutenberg support in general.
• Modified class targeting to allow inline rendering of nested SVGs (any level deep) when you can’t set the IMG class directly.
• Modified JS to use vanilla JS instead of jQuery.
• Fixed accessibility issues on settings page.
• Fixed dimensions metadata issue.
• Fixed division by 0 issue when SVG had no width or height set.
• Fixed featured image spacing issue in both classic and block editor.
• Bumped required PHP version.
• Removed obsolete admin notice.
• Removed srcset for SVG files.
• Removed directory name from filepath metadata.

2.3.21

• Fixed featured image SVG overlapping container.

2.3.20

• Fixed admin setting not being escaped when output.

2.3.19

• Fixed PHP Warning from localize_script in functions/enqueue.php.
• Added a check for SRC attribute in js/svgs-inline.js.

2.3.18

• Updated author URL in main plugin file.
• Updated donate links.
• Cleaned up plugin action meta links and settings page.
• Rolled back a fix in functions/attachment.php due to it removing meta from other attachments.

2.3.17

• Added setting to choose whether to load frontend CSS or not.

2.3.16

• Fix for files that have the XML declaration.
• Fix for PHP warnings from image widget.
• Some small CSS changes to the frontend when displaying SVG media attachments.

2.3.15

• Had to roll back a recent PHP warnings fix due to it breaking some theme compatibility.

2.3.14

• Fixed: Fatal error in some cases when removing old option from the database.

2.3.13

• Fixed: PHP warnings and notices from the image widget when using SVG files and wp_debug was on.
• Modified: Better front end CSS for displaying SVG attachments, both as images and inline.
• Removed: DB entry for deprecated admin notice.

2.3.12

• New: Native “Help” tab on the SVG Support settings page.
• New: Wrapped the inline JS in a function so you can call it at will using bodhisvgsInlineSupport();.
• Modified: Admin CSS to target SVG src only.
• Modified: SVG Support settings page – cleaned it up a little.
• Removed: Version update admin notice.

2.3.11

• New: Feature to use expanded JS file rather than the minified/compressed version (useful for bundling and minifying using external caching plugins).
• New: Force Inline SVG option. This feature allows you to force all of your SVG files to be rendered inline regardless of classes applied. Addresses issues where you can’t add your own class to an image for some reason. For example, some page builder image elements. Also addresses changing your target class in the settings and needing to change all of your already embedded media, allowing you to simply force render rather than update all of the classes.
• Modified the readme file and descriptions a bit.
• Refined some code in functions/featured-image.php line 69 to address a warning.
• Updated “Requires at least” tag to 4.8 (though it should still work in older versions, there was issues with core during the 4.7 phase and it’s time for you to update anyway).

2.3.10

• Fixed missing links in settings page.

2.3.9

• Modified plugin action meta link for settings page.
• Changed some language throughout the plugin.
• Added recommendation for ShortPixel Image Optimization.
• Added conditional to check post type supports thumbnail before setting meta data.

2.3.8

• Added some CSS to make sure featured images show on WooCommerce products, Sensei Courses and Lessons.
• Fix: Auto insert class setting was stripping featured image HTML in some cases.

2.3.7

• Added WP version check to wrap mime fix function needed for WP v4.7.1 – v4.7.2.
• Moved mime fix into mime type file.
• Modified admin notice code to make it neater.
• Fix: attachment-modal.php issues with some servers and external SVG files (props to @abstractourist & @malthejorgensen for providing fixes, as I could not consistently reproduce the issue).
• Compatibility: Changed a line to provide wider compatibility, specifically for WordPress Bedrock on a LEMP stack.
• Compatibility: Added another snippet to the JS to support IE11 (apparently people still use IE).
• Added more FAQ’s.

2.3.6

• New: Added polyfill to make svgs-inline.js work with older browsers.
• New: Section to leave reviews on settings page.
• Removed: Redundant one time upgrade activate code.
• Fix: Errors reported on activation and on the settings page – Related Support Thread.

2.3.5

• Revision and modification of the thumbnail display code.

2.3.4

• Fix: Fatal error for some because a function wasn’t prefixed.

2.3.3

• Fix: Missing arguments PHP warnings from new attribute control file.
• Update settings page text.

2.3.2

• Modified the attribute control code that auto inserts our class to only apply to SVG files.

2.3.1

• Fix: Fatal error in some cases due to admin notice.

2.3

• New Feature – Advanced Mode: allows you to turn off the advanced features and simply upload SVG files like normal images. This addition also enables users to turn off the script added on front end by leaving Advanced Mode unchecked.
• New Feature – Featured Image Support: If your featured image is SVG, once the post is saved you will see a checkbox to render the SVG inline (advanced mode only).
• Performance – Stop inlining JS from running if image source is not SVG.
• Added new stylesheet for settings page.
• Moved SCSS files to their own folder.
• Changed donate link so I can track it and properly thank you for your generous donations.
• Added a rating link to the settings and media pages.
• Cleaned up code formatting, added more comments.
• Added a plugin version check.
• Added notice so people are aware they may need to turn on the advanced mode.

2.2.5

• FIX: Display SVG thumbnails in attachment modals.

2.2.4

• FIX: Added function to temporarily fix an issue with uploading in WP 4.7.1

2.2.32

• Changed text domain to match plugin slug for localization.

2.2.31

• Attempt to fix ability to translate

2.2.3

• Modified code in svg-support/js/svg-inline.js and svg-support/js/min/svg-inline-min.js to allow JS control of the SVG elements and detect if they have been loaded (IMG tag swapped out). Thanks to laurosello for this suggestion and code contribution.
• Fixed SVG thumbnails not displaying correctly in list view of the media library.
• Cleaned up the code and comments a bit.
• Added translation for Spanish. Thanks to Apasionados del Marketing for the translation.

2.2.2

• Changed another anonymous function in svg-support/functions/thumbnail-display.php that was causing errors for some.

2.2.1

• Changed anonymous function in svg-support/functions/thumbnail-display.php line 15 to prevent fatal error in older PHP versions.

2.2

• Added support to make SVG thumbnails visible in all media library screens.
• Added SVGZ to the mime types.
• Automatically removes the width and height attributes when inserting SVG files.
• Added ability to choose whether the target class is automatically inserted into img tags or not, stripping the default WordPress classes.
• Added ability to choose whether script is output in footer – true or false.
• Blocked direct access to PHP files.
• Added SCSS support using CodeKit – minified CSS + JS files.
• Updated spelling for incorrect function name.
• Changed comment formatting across all files for consistency.
• Added link to $25 Free credit at GoWebben on the settings page.
• Tested in WordPress 4.3.
• Updated Readme file.

2.1.7

• Tested in WordPress 4.0 and added plugin icons for the new interface.

2.1.6

• Added missing jQuery dependency in /functions/enqueue.php (pointed out by walbach) – was loading SVG Support JS before jQuery.

2.1.5

• Added Serbian translation, submitted by Ogi Djuraskovic.

2.1.4

• Fixed plugin settings link (on plugins page)
• Added more links – Support & Donate
• Modified the settings page a little
• Cleaned up settings page with CSS
• Satisfied my OCD tendencies a little

2.1.3

• Added plugin_action_links file for custom menus on plugin page.

2.1.2

• Cleaned up trunk, tags and readme.txt to show correct changelog and update notice.

2.1.1

• Fixed JS file conditional – worked in local testing but not live.

2.1

• Updates to language files for localization.

2.0

• Added an admin settings page with instructions plus options for restricting to admin use only and setting a custom CSS target class.
• Whole plugin completely re-written and re-structured.
• Added option to restrict SVG uploads to administrators only.
• Added field for custom CSS target class.
• Added stylesheet to admin settings page.

1.0

• Initial Release.