AODN Free SVG Upload

Safely upload SVG files to WordPress with automatic sanitization. Real security, real previews, real role-based control. Free forever.

---

Why This Exists

WordPress blocks SVG uploads by default — and for good reason. SVG files are XML documents that can contain <script> tags, event handlers, XXE attack vectors, and external resource calls. Most SVG upload plugins either skip sanitization entirely or charge you $39/year for the privilege.

AODN Free SVG Upload fixes this properly: whitelist-based DOMDocument sanitization that strips every known attack vector, role-based upload control, and proper Media Library previews. Free. No upsell. No subscription. No catch.

Features

• Whitelist-based SVG sanitization — server-side DOMDocument parsing removes malicious code before the file touches your server
• 40+ allowed SVG elements — shapes, gradients, filters, animations, text, markers, and clipping paths all preserved
• 90+ allowed attributes — presentation, transforms, accessibility, and data attributes pass through
• 14 dangerous element categories blocked — <script>, <iframe>, <embed>, <object>, <foreignObject>, <applet>, and more
• All event handlers stripped — every on* attribute removed from every element
• Dangerous URI scheme blocking — javascript:, data:, vbscript:, blob:, and file: protocols blocked
• XXE attack prevention — DOCTYPE and ENTITY declarations stripped before parsing
• Role-based upload control — choose which user roles can upload SVGs (Administrator-only by default)
• Media Library SVG previews — SVGs display as actual images in grid and list views
• SVG dimension extraction — width/height read from viewBox or dimension attributes
• Automatic updates — new versions delivered through your WordPress dashboard
• Clean uninstall — all options and transients removed when you deactivate and delete

Screenshots

Settings Page

Media Library with SVG Previews

SVG File Details

Installation

From GitHub

1. Download the latest release
2. Upload the zip via WordPress Admin > Plugins > Add New > Upload Plugin
3. Activate — SVG uploads are immediately enabled and sanitized

Manual

1. Clone or download this repo
2. Copy the aodn-free-svg-upload folder to /wp-content/plugins/
3. Activate through Plugins in WordPress admin

No configuration required. It just works.

From AI Or Die Now

Download directly from our site with email-only registration:

Get AODN Free SVG Upload — free download, automatic updates included.

How the Sanitizer Works

1. Pre-parse cleanup — DOCTYPE declarations stripped to prevent XXE attacks. Processing instructions and CDATA sections removed.
2. Element whitelist — every DOM node checked against a strict whitelist. Unknown elements removed entirely.
3. Attribute scrubbing — all on* event handlers stripped. Dangerous URI schemes (javascript:, data:, vbscript:) removed from href attributes. Style attributes checked for expression() and dangerous url() references.
4. Final validation — regex sweep confirms no <script> tags or event handlers survived. If anything suspicious remains, the upload is blocked.

How It Compares

Feature	AODN Free SVG Upload	Safe SVG (Free)	SVG Support Pro ($39/yr)
SVG sanitization	Yes — whitelist	Yes	Yes
Role-based upload control	Yes	No	Yes
Media Library previews	Yes	Yes	Yes
XXE attack prevention	Yes	Partial	Yes
foreignObject blocking	Yes	Yes	No
Auto-updates	Yes	Via wordpress.org	Yes
Price	$0 — Free forever	Free	$39/year

Requirements

• WordPress 6.0 or higher
• PHP 7.4 or higher (PHP 8.x fully supported)
• PHP Extension: DOMDocument (enabled by default on virtually all hosts)
• Tested up to: WordPress 6.9

FAQ

Is this really free?

Yes. No catch. No premium tier. No upsell. No license key. No account required. AODN Free SVG Upload is open source (GPL v2) and will stay free forever. If you want advanced features like configurable file size limits, inline SVG rendering, and metadata stripping, check out Secure SVG Pro — a one-time $19 purchase.

Is it safe for production?

Yes. The plugin was tested by 7 independent AI models across 3 review rounds before release. Every SVG is parsed by PHP's DOMDocument, checked against strict element and attribute whitelists, and scrubbed of all known attack vectors.

How do updates work?

Automatic updates via your WordPress dashboard — same as any plugin. When a new version is available, you'll see the notification in your Plugins page.

Will sanitization break my SVGs?

No. The sanitizer preserves all visual SVG elements — shapes, gradients, filters, animations, text, clipping paths, and transforms. Only dangerous elements and attributes are removed.

Contributing

This is open source under GPL v2. Fork it, customize it, submit PRs. If you find a bug, open an issue.

Support

• AI Or Die Now — our home base
• Product page — full description, demo video, and free download
• All plugins — browse our complete plugin catalog
• Report an issue
• Email: support@aiordienow.com

Changelog

1.0.0

• Initial release
• SVG upload with automatic whitelist-based sanitization
• Media Library preview support (grid and list views)
• Role-based upload permissions
• SVG dimension extraction from viewBox/attributes
• XSS, XXE, and injection protection
• Automatic updates from updates.aiordienow.com
• Clean uninstall (removes all options and transients)

License

GPL v2 or later. See LICENSE for full text.

---

Built by AI Or Die Now — Premium WordPress plugins, no subscriptions.