Compatibility Fix for Safe SVG
Problem: With “Safe SVG” alone, uploading SVG files into the WordPress Media Library works fine. As soon as you try to replace an existing file with an SVG via the “Enable Media Replace” plugin, the operation aborts with the message “Sorry, this file type is not permitted for security reasons.” . Ro
About this tool.
Problem:
With “Safe SVG” alone, uploading SVG files into the WordPress Media Library works fine. As soon as you try to replace an existing file with an SVG via the “Enable Media Replace” plugin, the operation aborts with the message “Sorry, this file type is not permitted for security reasons.” .
Root cause: EMR calls wp_check_filetype_and_ext() directly from its own submenu ( upload.php?page=enable-media-replace/... ) without going through the standard upload path ( wp_handle_upload ). Safe SVG, however, registers its MIME-type fix only on certain admin page hooks — and those do not reliably fire on the EMR replace page in practice.
Solution:
This plugin registers the two required filters ( upload_mimes , wp_check_filetype_and_ext ) globally so that SVG uploads work through EMR as well.
Safety guard:
So that this plugin does not open an unsanitized SVG upload path, the filters are active only when the “Safe SVG” plugin itself is active. Safe SVG then handles the SVG sanitization on wp_handle_upload_prefilter / wp_handle_sideload_prefilter . Without an active Safe SVG, SVG remains non-uploadable.
Getting started.
- 01In the WordPress admin go to Plugins → Add New → Upload Plugin and upload the ZIP file.
- 02Activate the plugin.
- 03Make sure that “Safe SVG” and “Enable Media Replace” are also active.
- 04Replace an existing media item with an SVG file via “Replace media” — it now works.
Frequently asked questions.
Do I really need Safe SVG?
Yes. Without Safe SVG the filters of this plugin stay inactive. This is intentional: SVG uploads without a sanitizer would be an XSS risk (embedded JavaScript / SVG smuggling).
Does the plugin also work with other replace plugins?
Yes. The two filters are generic and apply to any plugin that calls wp_check_filetype_and_ext() directly.
Does the plugin also work in WP-CLI / Cron / REST sideloads?
Yes. As of version 1.1.0 the filters no longer perform a capability check, so SVG uploads also work in contexts without a logged-in user (for example programmatic sideloads via REST or WP-CLI). Security is still enforced through the Safe-SVG-active guard and Safe SVG’s sanitization on wp_handle_upload_prefilter .
