SVG Enabler

By default only administrators (users with the manage_options capability) can upload SVG files. Everyone else is blocked, because SVG is the one image format that can execute code.

You can change this with the optimisthub_svg_enabler_capability filter. For example, to let editors upload SVG as well:

add_filter( 'optimisthub_svg_enabler_capability', function ( $capability ) { return 'edit_others_posts'; } );

Return an empty string to allow anyone who can upload files.

Yes, this can be done using the optimisthub_svg_enabler_allowed_attributes and optimisthub_svg_enabler_allowed_tags filters. They take one argument that must be returned.

add_filter( 'optimisthub_svg_enabler_allowed_attributes', function ( $attributes ) { $attributes[] = 'target'; // This would allow the target="" attribute. return $attributes; } ); add_filter( 'optimisthub_svg_enabler_allowed_tags', function ( $tags ) { $tags[] = 'use'; // This would allow the <use> element. return $tags; } );

The file either was not valid XML, did not contain an <svg> root element, or could not be sanitized. Rejected files are never stored. Try re-saving the file with a vector editor such as Inkscape or Illustrator.

It removes the known dangerous constructs from uploaded SVG files and keeps the sanitizer library up to date. No sanitizer can be considered a complete guarantee, which is why upload permission is restricted to administrators by default. Only upload SVG files from sources you trust.

Yes, .svgz files use the same MIME type and are sanitized the same way.