=== SVG Media Upload Enabler ===
Contributors: spp
Tags: svg, media, upload, security, media library
Requires at least: 6.0
Tested up to: 7.0
Requires PHP: 7.4
Stable tag: 1.0.0
License: GPLv2 or later
License URI: https://www.gnu.org/licenses/gpl-2.0.html

Safely enable SVG uploads in the WordPress Media Library for administrators with automatic markup sanitization.

== Description ==

SVG Media Upload Enabler allows site administrators to upload SVG graphic files through the native WordPress Media Library. Every uploaded SVG is scanned and cleaned before it is stored, removing inline JavaScript, script elements, and other common exploit vectors.

**Features**

* Adds `image/svg+xml` to allowed upload mime types for administrators.
* Sanitizes SVG files on upload using DOMDocument parsing.
* Verifies each SVG with a security scan and marks files as Secure or Not secure.
* Avoids WordPress upload crunching errors by handling SVG attachment metadata correctly.
* Strips `<script>` tags, event handler attributes, and dangerous embedded content.
* Blocks uploads when malicious content cannot be removed safely.
* Displays SVG thumbnails and previews in the admin Media Library grid and modal.
* Includes an admin status navigator under Media > SVG Upload Status.

== Installation ==

1. Upload the plugin files to the `/wp-content/plugins/svg-media-upload-enabler` directory, or install the plugin through the WordPress plugins screen.
2. Activate the plugin through the **Plugins** screen in WordPress.
3. Open **Media > SVG Upload Status** to review implemented features and server requirements.
4. Upload SVG files from **Media > Add New** while logged in as an administrator.

== Frequently Asked Questions ==

= Who can upload SVG files? =

Only users with the `manage_options` capability (typically administrators) can upload SVG files when this plugin is active.

= Are uploaded SVG files modified? =

Yes. Potentially dangerous markup is removed from the file before WordPress saves it to your uploads directory.

= What happens if an SVG contains malicious code? =

The file is sanitized first, then scanned. If threats remain, the upload is rejected and an error message is shown in the Media Library uploader.

= How do I verify an SVG is secure? =

Open **Media** and check the **SVG Security** column. Secure files show **Secure**. You can also open an attachment and review the **SVG Security Scan** panel, or click **Rescan file** to run the scan again.

= Where can I see which features are implemented? =

Go to **Media > SVG Upload Status** in the WordPress admin. You can also click **Status** on the Plugins screen.

== Changelog ==

= 1.0.0 =
* Initial release.
* Administrator-only SVG mime type support.
* Upload-time SVG sanitization via DOMDocument.
* Tested up to WordPress 7.0.

== Upgrade Notice ==

= 1.0.0 =
Initial release.
