I'm developing a plugin. In its settings page I want to use SVG icons. This is how I render SVG icons:

<div class="svg-wrap">
  <?php echo file_get_contents(ABSPATH . 'wp-content/plugins/my-plugin/img/icon.svg') ?>

I create the SVG icons myself. Does it make sense to sanitize SVG using wp_kses() or is it completely pointless?

1 Answer 1


It's not completely pointless, but probably smart to sanitize, because of the following situations:

  1. What's the certainty that the SVGs only come from you directly?
  2. Can you guarantee that the SVGs won't be intercepted during upload?

Redundancies for keeping your site secure are generally recommended.

I don't know that wp_kses() is the best for sanitizing SVGs though. I'd reference Safe SVG and see how that sanitizes.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.