外掛說明

使用 Safe SVG 外掛是在 WordPress 網站上開放 SVG 檔案上傳的最佳方式。

這個外掛能開放 WordPress 網站上傳 SVG 檔案的功能，並確保 SVG 檔案經過必要的處理，以避免觸發 SVG/XML 漏洞影響網站，同時也能讓使用者在媒體庫的各種檢視模式中預覽已上傳的 SVG 檔案。

目前功能

處理 SVG 檔案：不會允許未經處理的 SVG 檔案上傳，以避免觸發 WordPress 網站的安全性漏洞。
SVGO 最佳化：在上傳 SVG 檔案時使用 SVGO 工具最佳化以節省網站儲存空間。這項功能預設為停用，但可以使用所列程式碼加以啟用：add_filter( 'safe_svg_optimizer_enabled', '__return_true' );
在媒體庫中檢視 SVG 檔案：不需要去回想哪個 SVG 檔案是哪天上傳的，這個外掛提供在 WordPress 媒體庫中預覽 SVG 檔案的功能。
設定可上傳 SVG 檔案的使用者：設定指定使用者才能上傳 SVG 檔案，或開放全部使用者均可上傳。

開發這個外掛的想法源自 #24251 這個功能需求。

SVG 檔案的處理使用 https://github.com/darylldoyle/svg-sanitizer 所提供的函式庫。

已透過所列函式庫完成 SVG 最佳化功能：https://github.com/svg/svgo。

適用於區塊編輯器

這個外掛提供 1 個可供 Gutenberg/區塊編輯器使用的區塊。

Safe SVG Display the SVG icon

安裝方式

透過 WordPress 外掛目錄安裝，或下載安裝檔案後解壓縮，上傳解壓縮所得的資料夾及其全部檔案至 /wp-content/plugins/ 目錄。

常見問題集

是否能變更開放使用的屬性及標籤？

可以，這可以透過 svg_allowed_attributes 及 svg_allowed_tags 篩選器完成。
這 2 個篩選器分別使用一個必須回傳值的引數。以下是範例程式碼：

add_filter( 'svg_allowed_attributes', function ( $attributes ) {

    // Do what you want here...

    // This should return an array so add your attributes to
    // to the $attributes array before returning it. E.G.

    $attributes[] = 'target'; // This would allow the target="" attribute.

    return $attributes;
} );


add_filter( 'svg_allowed_tags', function ( $tags ) {

    // Do what you want here...

    // This should return an array so add your tags to
    // to the $tags array before returning it. E.G.

    $tags[] = 'use'; // This would allow the <use> element.

    return $tags;
} );

使用者評論

Reza Asadi 2025 年 11 月 19 日 1 則留言

Nice And Easy plugin for using SVG files

rrvoigt 2025 年 6 月 21 日 1 則留言

Would have given a 5 star, but it seems support is missing for the taxonomy / terms section (like in categories) upload for SVG images. Keep getting an error that the upload isn’t supported. Hopefully this will be fixed in a future update. Will update once this is added. Cheers!

Stefano 2025 年 4 月 30 日 1 則留言

Great plugin! very usefull, but please can you add the possibility to add an inline SVG on the block pasting svg code? Thanks!

bandgamin 2025 年 3 月 25 日 1 則留言

Thanks to the plugin developers. The plugin helped me solve my issue.

Jimmy Lee 2024 年 11 月 14 日 1 則留言

Thanks for creating this plugin!

headfalcon 2024 年 7 月 31 日

I didn’t look into it but this plugin caused my homepage in translations to take about 30 seconds to load, instead of 1-2. We use WPML. It was back to normal the moment I deleted the plugin.

閱讀全部 76 則使用者評論

參與者及開發者

以下人員參與了開源軟體〈Safe SVG〉的開發相關工作。

〈Safe SVG〉外掛目前已有 29 個本地化語言版本。感謝全部譯者為這個外掛做出的貢獻。

將〈Safe SVG〉外掛本地化為台灣繁體中文版

對開發相關資訊感興趣？

任何人均可瀏覽程式碼、查看 SVN 存放庫，或透過 RSS 訂閱開發記錄。

變更記錄

2.4.0 – 2025-09-22

Added: Ability to upload SVGs from more admin locations (props @stormrockwell, @darylldoyle, @wpexplorer, @smerriman, @jeffpaul, @dkotter via #279).
Changed: Added $attachment_id argument to filters safe_svg_use_width_height_attributes and safe_svg_dimensions (props @roborourke, @dkotter via #278).
Fixed: Inconsistent or incorrect data type for $svg argument in the filters safe_svg_use_width_height_attributes and safe_svg_dimensions (props @roborourke, @dkotter via #278).

2.3.3 – 2025-08-13

Security: Update the enshrined/svg-sanitize package from 0.19.0 to 0.22.0 to fix an issue with case-insensitive attributes slipping through the sanitiser and address PHP 8.4 deprecation warnings (props @darylldoyle, @sudar, @georgestephanis, @dkotter, @realazizk via #268, #272).
Security: Bump form-data from 4.0.0 to 4.0.4 (props @dependabot, @faisal-alvi via #270).
Security: Bump tmp from 0.2.3 to 0.2.5 and @inquirer/editor from 4.2.9 to 4.2.16 (props @dependabot, @dkotter via #271).

2.3.2 – 2025-07-21

Fixed: Visual parity between the front end and the block editor (props @s3rgiosan, @dkotter via #261, #266).
Changed: Bump WordPress “tested up to” version 6.8 (props @godleman, @jeffpaul, @dkotter via #251, #254).
Changed: Bump WordPress minimum supported version to 6.6 (props @godleman, @jeffpaul, @dkotter via #254).
Security: Bump ws from 7.5.10 to 8.18.0, @wordpress/scripts from 27.9.0 to 30.6.0, nanoid from 3.3.7 to 3.3.8 and mocha from 10.2.0 to 11.0.1 (props @dependabot, @peterwilsoncc via #245).
Security: Bump @babel/runtime from 7.23.9 to 7.27.0, axios from 1.7.4 to 1.8.4, cookie from 0.4.2 to 0.7.1, express from 4.21.0 to 4.21.2 and @wordpress/e2e-test-utils-playwright from 0.26.0 to 1.20.0 (props @dependabot, @dkotter via #250).
Security: Bump http-proxy-middleware from 2.0.6 to 2.0.9 (props @dependabot, @iamdharmesh via #253).
Security: Bump tar-fs from 3.0.8 to 3.0.9 (props @dependabot, @dkotter via #258).
Security: Bump bytes from 3.0.0 to 3.1.2 and compression from 1.7.4 to 1.8.1 (props @dependabot, @dkotter via #265).

2.3.1 – 2024-12-05

Fixed: Revert changes made to how we determine custom dimensions for SVGs (props @dkotter, @martinpl, @subfighter3, @smerriman, @gigatyrant, @jeffpaul, @iamdharmesh via #238).

2.3.0 – 2024-11-25

Added: New setting that allows large SVG files (roughly 10MB or greater) to be uploaded and sanitized properly (props @kirtangajjar, @faisal-alvi, @darylldoyle, @manojsiddoji, @dkotter via #201).
Added: New get_svg_dimensions function in order to reduce code duplication (props @gabriel-glo, @jeremymoore, @darylldoyle, @iamdharmesh, @dkotter via #216).
Changed: Updated the enshrined/svg-sanitize package from 0.16.0 to 0.19.0 to fix a PHP 8.3 compatibility issue (props @sksaju, @TylerB24890, @darylldoyle, @rolf-yoast, @faisal-alvi via #214).
Changed: Update how image dimensions are passed in get_image_tag_override and one_pixel_fix methods (props @gabriel-glo, @jeremymoore, @darylldoyle, @iamdharmesh, @dkotter via #216).
Changed: Bump WordPress “tested up to” version to 6.7 (props @colinswinney, @jeffpaul via #232, #233).
Changed: Bump WordPress minimum from 6.4 to 6.5 (props @colinswinney, @jeffpaul via #232, #233).
Changed: Remove composer dev dependencies from archived project (props @TylerB24890, @szepeviktor, @peterwilsoncc via #220).
Fixed: Use proper block category for the Safe SVG Icon block (props @kirtangajjar, @fabiankaegy via #226).
Security: Only allow SVG file types to be uploaded if our sanitizer is able to run on those files (props @darylldoyle, @xknown, @dkotter via #228).
Security: Bump webpack from 5.90.1 to 5.94.0 (props @dependabot, @peterwilsoncc via #222).
Security: Bump ws from 7.5.10 to 8.18.0, serve-static from 1.15.0 to 1.16.2 and express from 4.19.2 to 4.21.0 (props @dependabot, @Sidsector9, @faisal-alvi via #227, #230, #234).

2.2.6 – 2024-08-28

Changed: Bump WordPress “tested up to” version to 6.6 (props @sudip-md, @ankitguptaindia, @jeffpaul via #212, #213).
Changed: Bump WordPress minimum from 5.7 to 6.4 (props @sudip-md, @ankitguptaindia, @jeffpaul via #212, #213).
Security: Add svg sanitization on the wp_handle_sideload_prefilter filter (props @dkotter, @xknown, @iamdharmesh via GHSA-3vr7-86pg-hf4g).
Security: Bump braces from 3.0.2 to 3.0.3, pac-resolver from 7.0.0 to 7.0.1, socks from 2.7.1 to 2.8.3, ws from 7.5.9 to 7.5.10 and remove ip (props @dependabot, @Sidsector9 via #206).
Security: Bump axios from 1.6.7 to 1.7.4 (props @dependabot, @faisal-alvi via #218).

View historical changelog details here.

Safe SVG

外掛說明

目前功能

適用於區塊編輯器

安裝方式

常見問題集

是否能變更開放使用的屬性及標籤？

使用者評論

Nice And Easy

Good plugin, but missing …

Wonderful + fetaure request

ELEMENTOR+Safe SVG=It works

Effortless

Caused very long loading times in homepage translations (wpml)

參與者及開發者

對開發相關資訊感興趣？

變更記錄

2.4.0 – 2025-09-22

2.3.3 – 2025-08-13

2.3.2 – 2025-07-21

2.3.1 – 2024-12-05

2.3.0 – 2024-11-25

2.2.6 – 2024-08-28

社群版外掛

評分

參與者

技術支援

外掛說明

目前功能

適用於區塊編輯器

安裝方式

常見問題集

是否能變更開放使用的屬性及標籤？

使用者評論

參與者及開發者

對開發相關資訊感興趣？

變更記錄

2.4.0 – 2025-09-22

2.3.3 – 2025-08-13

2.3.2 – 2025-07-21

2.3.1 – 2024-12-05

2.3.0 – 2024-11-25

2.2.6 – 2024-08-28

社群版外掛

中繼資料

評分

參與者

技術支援