` or `<desc>` accessibility content. ### Can I use SVGs with Elementor or other page builders? Uploaded SVG files behave as Media Library attachments. The `[saniglyph_svg]` shortcode can also be used anywhere shortcodes are supported when inline rendering is enabled. ### Does the plugin send data anywhere? No. SaniGlyph SVG does not contact external services, collect telemetry, or load remote JavaScript or CSS. ## Reviews There are no reviews for this plugin. ## Contributors & Developers “SaniGlyph SVG” is open source software. The following people have contributed to this plugin. Contributors * [ shahidirfan100 ](https://profiles.wordpress.org/shahidirfan100/) [Translate “SaniGlyph SVG” into your language.](https://translate.wordpress.org/projects/wp-plugins/saniglyph-svg) ### Interested in development? [Browse the code](https://plugins.trac.wordpress.org/browser/saniglyph-svg/), check out the [SVN repository](https://plugins.svn.wordpress.org/saniglyph-svg/), or subscribe to the [development log](https://plugins.trac.wordpress.org/log/saniglyph-svg/) by [RSS](https://plugins.trac.wordpress.org/log/saniglyph-svg/?limit=100&mode=stop_on_copy&format=rss). ## Changelog #### 1.1.7 * Escaped all shortcode and dynamic-block callback output with `wp_kses()` and a dedicated SVG/attachment-image allowlist. * Scoped SVG CSS allowlist filters to the individual render operation so other WordPress content is unaffected. * Preserved approved SVG fills, strokes, gradients, filters, local fragment references, and presentation styles through output escaping. * Hardened CSS value validation against escape-sequence and comment-obfuscation bypasses before enabling the scoped KSES compatibility filters. * Documented the plugin’s distinct fail-closed, multi-stage validation and visual- fidelity workflow. #### 1.1.6 * Updated the WordPress.org `Tested up to` header to 7.1 for current-directory compatibility. * Synchronized plugin, block, readme, dashboard, and release-package metadata at version 1.1.6. * Re-audited the submission package for WordPress.org metadata, security, privacy, external-service, and packaging requirements. #### 1.1.5 * Reworked the dashboard logo for clear rendering at WordPress admin sizes. * Simplified the shield and SVG path, increased usable logo size, and removed the translucent background tile that reduced contrast. * Preserved the existing navy, royal-blue, violet, and white brand palette. #### 1.1.4 * Added a distinct SaniGlyph brand mark to the plugin settings dashboard without changing the existing color scheme. * Added WordPress.org icon, banner, and screenshot assets as a separate distribution package. * Added a separate screenshot-based user guide and release documentation to keep the installed plugin lightweight. * Updated release metadata and asset versions consistently. #### 1.1.3 * Fixed SVG artwork becoming black or losing appearance after upload/inline rendering. * Changed the security pipeline from destructive cleanup to fail-closed validation: unsafe or unsupported SVGs are rejected, while accepted SVG source is preserved unchanged by the validator. * Removed the extra HTML-oriented KSES rewrite from the inline-rendering path after strict SVG validation, preventing valid SVG presentation attributes and styles from being normalized away. * Added common root attributes such as `version` and `baseProfile` to the SVG allowlist. * Added a regression test against an Adobe Illustrator-exported SVG containing white/off-white and dark inline fills; all 14 style declarations are preserved and the rendered result is pixel-identical before and after the upload pipeline. #### 1.1.2 * Fixed SVGs losing their original colors and appearing blank after upload. * Restored safe support for inline `style` attributes and class-based `<style>` rules used by Illustrator, Figma, Inkscape, and common icon exporters. * Added a strict CSS property/value allowlist so styling is preserved without allowing remote URLs, executable CSS, imports, or unsafe data schemes. * Expanded the SVG presentation allowlist for gradients, filters, clipping, masks, markers, text styling, and common filter primitives. * Preserved local `url(#id)` paint/filter references while continuing to reject external references. #### 1.1.1 * Prefixed all settings-view variables and loop variables with the plugin-specific` sgsvg_` prefix to satisfy WordPress Coding Standards `PrefixAllGlobals`. * No functional behavior changed. #### 1.1.0 * Rebranded the pre-release plugin from Pro SVG Manager to SaniGlyph SVG. * Matched the plugin folder, main file, text domain, block namespace, settings keys, and asset handles to the new identity. * Replaced short global identifiers with the collision-resistant five-letter `sgsvg_`/` SGSVG_` prefix. * Rebuilt SVG sanitization around a strict DOM allowlist and fail-closed behavior. * Added explicit DOM-extension availability checks and an administrator notice; uploads remain disabled when secure parsing is unavailable. * Made sanitization permanently enabled and removed the unsafe regex fallback. * Removed SVGZ support to prevent compressed-file sanitization bypasses. * Blocked DTDs, external entities, event attributes, remote references, and executable URL schemes. * Added a second sanitization pass after optimization and another security pass for inline rendering. * Replaced geometry-changing optimization with conservative serialization that preserves meaningful SVG text spacing. * Preserved SVG title and description elements for accessibility. * Added validation against WordPress roles and the core upload_files capability, with administrators as the secure default for new installs. * Reworked SVG dimension detection and Media Library preview metadata. * Added a functional dynamic Inline SVG block using block.json and moved the pre- release shortcode to the collision-resistant `[saniglyph_svg]` tag. * Redesigned the settings screen with a responsive, accessible, dependency-free admin interface. * Replaced jQuery admin behavior with lightweight vanilla JavaScript. * Removed placeholder URLs, development repository files, cache-flush behavior, and unnecessary rewrite flushing. * Updated compatibility metadata for WordPress 7.0 and PHP 7.4+. #### 1.0.0 * Initial pre-release build as Pro SVG Manager. ## Meta * Version **1.1.7** * Last updated **3 days ago** * Active installations **Fewer than 10** * WordPress version ** 6.4 or higher ** * Tested up to **7.1** * PHP version ** 7.4 or higher ** * Tags * [block](https://wordpress.org/plugins/tags/block/)[media](https://wordpress.org/plugins/tags/media/) [optimization](https://wordpress.org/plugins/tags/optimization/)[security](https://wordpress.org/plugins/tags/security/) [SVG](https://wordpress.org/plugins/tags/svg/) * [Advanced View](https://wordpress.org/plugins/saniglyph-svg/advanced/) ## Ratings No reviews have been submitted yet. [Your review](https://wordpress.org/support/plugin/saniglyph-svg/reviews/#new-post) [See all reviews](https://wordpress.org/support/plugin/saniglyph-svg/reviews/) ## Contributors * [ shahidirfan100 ](https://profiles.wordpress.org/shahidirfan100/) ## Support Got something to say? Need help? [View support forum](https://wordpress.org/support/plugin/saniglyph-svg/)

Title: SaniGlyph SVG Author: shahidirfan100 Published: August 30, 2026 Last modified: August 30, 2026 --- Search plugins ![](https://ps.w.org/saniglyph-svg/assets/banner-772x250.png?rev=3672338) ![](https://ps.w.org/saniglyph-svg/assets/icon-256x256.png?rev=3672338) # SaniGlyph SVG By [shahidirfan100](https://profiles.wordpress.org/shahidirfan100/) [Download](https://downloads.wordpress.org/plugin/saniglyph-svg.1.1.7.zip) * [Details](https://wordpress.org/plugins/saniglyph-svg/#description) * [Reviews](https://wordpress.org/plugins/saniglyph-svg/#reviews) * [Installation](https://wordpress.org/plugins/saniglyph-svg/#installation) * [Development](https://wordpress.org/plugins/saniglyph-svg/#developers) [Support](https://wordpress.org/support/plugin/saniglyph-svg/) ## Description SaniGlyph SVG enables SVG uploads for selected WordPress roles while keeping sanitization permanently enabled. SVG files are XML-based and can contain active or externally referenced content. SaniGlyph SVG uses a fail-closed, allowlist-based validation pipeline before an uploaded SVG is stored. Unsafe or unsupported SVGs are rejected rather than silently rewritten. Valid SVGs keep their original fills, strokes, CSS, gradients, XML formatting, and exporter-specific presentation markup. #### Features * Always-on SVG sanitization. It cannot be disabled from the settings screen. * Plain `.svg` uploads only. Compressed `.svgz` uploads are intentionally not enabled. * Conservative optimization that preserves geometry, text spacing, and title/description accessibility content. * Role-based upload permissions in addition to WordPress’ normal `upload_files` capability; administrators are the secure default for new installs. * SVG dimensions and previews in the Media Library. * Optional inline rendering through the `[saniglyph_svg]` shortcode. * Dynamic Inline SVG block for the block editor. * No external services, telemetry, tracking, or remote code. #### Inline shortcode Enable inline rendering under **Settings > SaniGlyph SVG**, then use: ``` [saniglyph_svg id="123"] ``` Optional attributes: ``` [saniglyph_svg id="123" class="site-logo" width="160" height="48"] ``` Inline output is validated again at render time and escaped with a dedicated SVG KSES allowlist immediately before WordPress renders it. Scoped CSS rules preserve approved fills, strokes, gradients, filters, and local fragment references without changing KSES behavior elsewhere on the site. #### What makes SaniGlyph different? SaniGlyph focuses on a narrow security-and-fidelity workflow rather than merely adding the SVG MIME type. It rejects the complete upload when unsupported active content is found instead of silently removing pieces from the artwork. Accepted files pass validation before storage, again after optional optimization, and again before inline output. Inline shortcode and block callbacks then apply WordPress KSES output escaping with SVG-specific rules scoped to that single render operation. ## Screenshots [⌊Branded settings overview with the current security status and core SVG protections.⌉⌊ Branded settings overview with the current security status and core SVG protections .⌉[ Branded settings overview with the current security status and core SVG protections. [⌊Rendering and optimization controls, including optional inline SVG output.⌉⌊Rendering and optimization controls, including optional inline SVG output.⌉[ Rendering and optimization controls, including optional inline SVG output. [⌊Role-based SVG upload permissions with administrators selected by default.⌉⌊Role- based SVG upload permissions with administrators selected by default.⌉[ Role-based SVG upload permissions with administrators selected by default. [⌊Inline shortcode quick-use panel and save controls.⌉⌊Inline shortcode quick-use panel and save controls.⌉[ Inline shortcode quick-use panel and save controls. ## Blocks This plugin provides 1 block. * Inline SVG Render a sanitized SVG attachment inline. ## Installation 1. Upload the `saniglyph-svg` folder to `/wp-content/plugins/`, or install the ZIP through **Plugins > Add New > Upload Plugin**. 2. Activate **SaniGlyph SVG**. 3. Go to **Settings > SaniGlyph SVG**. 4. Choose which roles may upload SVG files and configure the optional optimization and inline-rendering features. ## FAQ ### Why can’t I disable sanitization? Allowing unsanitized SVG uploads would remove the plugin’s main security boundary. Sanitization is therefore always active. ### Does SaniGlyph SVG require the PHP DOM extension? Yes. The DOM extension is required for the strict XML sanitizer. If DOM is unavailable, SaniGlyph SVG keeps SVG uploads disabled rather than falling back to weaker pattern- based sanitization. ### Does SaniGlyph SVG support SVGZ files? No. The plugin intentionally enables only plain `.svg` uploads so compressed content cannot bypass the normal sanitization path. ### Does optimization change SVG geometry? No. The optimizer is intentionally conservative. It does not round coordinates and does not remove `` or `<desc>` accessibility content. ### Can I use SVGs with Elementor or other page builders? Uploaded SVG files behave as Media Library attachments. The `[saniglyph_svg]` shortcode can also be used anywhere shortcodes are supported when inline rendering is enabled. ### Does the plugin send data anywhere? No. SaniGlyph SVG does not contact external services, collect telemetry, or load remote JavaScript or CSS. ## Reviews There are no reviews for this plugin. ## Contributors & Developers “SaniGlyph SVG” is open source software. The following people have contributed to this plugin. Contributors * [ shahidirfan100 ](https://profiles.wordpress.org/shahidirfan100/) [Translate “SaniGlyph SVG” into your language.](https://translate.wordpress.org/projects/wp-plugins/saniglyph-svg) ### Interested in development? [Browse the code](https://plugins.trac.wordpress.org/browser/saniglyph-svg/), check out the [SVN repository](https://plugins.svn.wordpress.org/saniglyph-svg/), or subscribe to the [development log](https://plugins.trac.wordpress.org/log/saniglyph-svg/) by [RSS](https://plugins.trac.wordpress.org/log/saniglyph-svg/?limit=100&mode=stop_on_copy&format=rss). ## Changelog #### 1.1.7 * Escaped all shortcode and dynamic-block callback output with `wp_kses()` and a dedicated SVG/attachment-image allowlist. * Scoped SVG CSS allowlist filters to the individual render operation so other WordPress content is unaffected. * Preserved approved SVG fills, strokes, gradients, filters, local fragment references, and presentation styles through output escaping. * Hardened CSS value validation against escape-sequence and comment-obfuscation bypasses before enabling the scoped KSES compatibility filters. * Documented the plugin’s distinct fail-closed, multi-stage validation and visual- fidelity workflow. #### 1.1.6 * Updated the WordPress.org `Tested up to` header to 7.1 for current-directory compatibility. * Synchronized plugin, block, readme, dashboard, and release-package metadata at version 1.1.6. * Re-audited the submission package for WordPress.org metadata, security, privacy, external-service, and packaging requirements. #### 1.1.5 * Reworked the dashboard logo for clear rendering at WordPress admin sizes. * Simplified the shield and SVG path, increased usable logo size, and removed the translucent background tile that reduced contrast. * Preserved the existing navy, royal-blue, violet, and white brand palette. #### 1.1.4 * Added a distinct SaniGlyph brand mark to the plugin settings dashboard without changing the existing color scheme. * Added WordPress.org icon, banner, and screenshot assets as a separate distribution package. * Added a separate screenshot-based user guide and release documentation to keep the installed plugin lightweight. * Updated release metadata and asset versions consistently. #### 1.1.3 * Fixed SVG artwork becoming black or losing appearance after upload/inline rendering. * Changed the security pipeline from destructive cleanup to fail-closed validation: unsafe or unsupported SVGs are rejected, while accepted SVG source is preserved unchanged by the validator. * Removed the extra HTML-oriented KSES rewrite from the inline-rendering path after strict SVG validation, preventing valid SVG presentation attributes and styles from being normalized away. * Added common root attributes such as `version` and `baseProfile` to the SVG allowlist. * Added a regression test against an Adobe Illustrator-exported SVG containing white/off-white and dark inline fills; all 14 style declarations are preserved and the rendered result is pixel-identical before and after the upload pipeline. #### 1.1.2 * Fixed SVGs losing their original colors and appearing blank after upload. * Restored safe support for inline `style` attributes and class-based `<style>` rules used by Illustrator, Figma, Inkscape, and common icon exporters. * Added a strict CSS property/value allowlist so styling is preserved without allowing remote URLs, executable CSS, imports, or unsafe data schemes. * Expanded the SVG presentation allowlist for gradients, filters, clipping, masks, markers, text styling, and common filter primitives. * Preserved local `url(#id)` paint/filter references while continuing to reject external references. #### 1.1.1 * Prefixed all settings-view variables and loop variables with the plugin-specific` sgsvg_` prefix to satisfy WordPress Coding Standards `PrefixAllGlobals`. * No functional behavior changed. #### 1.1.0 * Rebranded the pre-release plugin from Pro SVG Manager to SaniGlyph SVG. * Matched the plugin folder, main file, text domain, block namespace, settings keys, and asset handles to the new identity. * Replaced short global identifiers with the collision-resistant five-letter `sgsvg_`/` SGSVG_` prefix. * Rebuilt SVG sanitization around a strict DOM allowlist and fail-closed behavior. * Added explicit DOM-extension availability checks and an administrator notice; uploads remain disabled when secure parsing is unavailable. * Made sanitization permanently enabled and removed the unsafe regex fallback. * Removed SVGZ support to prevent compressed-file sanitization bypasses. * Blocked DTDs, external entities, event attributes, remote references, and executable URL schemes. * Added a second sanitization pass after optimization and another security pass for inline rendering. * Replaced geometry-changing optimization with conservative serialization that preserves meaningful SVG text spacing. * Preserved SVG title and description elements for accessibility. * Added validation against WordPress roles and the core upload_files capability, with administrators as the secure default for new installs. * Reworked SVG dimension detection and Media Library preview metadata. * Added a functional dynamic Inline SVG block using block.json and moved the pre- release shortcode to the collision-resistant `[saniglyph_svg]` tag. * Redesigned the settings screen with a responsive, accessible, dependency-free admin interface. * Replaced jQuery admin behavior with lightweight vanilla JavaScript. * Removed placeholder URLs, development repository files, cache-flush behavior, and unnecessary rewrite flushing. * Updated compatibility metadata for WordPress 7.0 and PHP 7.4+. #### 1.0.0 * Initial pre-release build as Pro SVG Manager. ## Meta * Version **1.1.7** * Last updated **3 days ago** * Active installations **Fewer than 10** * WordPress version ** 6.4 or higher ** * Tested up to **7.1** * PHP version ** 7.4 or higher ** * Tags * [block](https://wordpress.org/plugins/tags/block/)[media](https://wordpress.org/plugins/tags/media/) [optimization](https://wordpress.org/plugins/tags/optimization/)[security](https://wordpress.org/plugins/tags/security/) [SVG](https://wordpress.org/plugins/tags/svg/) * [Advanced View](https://wordpress.org/plugins/saniglyph-svg/advanced/) ## Ratings No reviews have been submitted yet. [Your review](https://wordpress.org/support/plugin/saniglyph-svg/reviews/#new-post) [See all reviews](https://wordpress.org/support/plugin/saniglyph-svg/reviews/) ## Contributors * [ shahidirfan100 ](https://profiles.wordpress.org/shahidirfan100/) ## Support Got something to say? Need help? [View support forum](https://wordpress.org/support/plugin/saniglyph-svg/)