Enable SVG uploads and sanitize them to stop XML/SVG vulnerabilities in your WordPress website.
C-Rank Grade: D (Risky) - 19/100
External PR Merge Rate: -
Response Time: -
First Timer Success: -
10up/safe-svg has a recorded first-timer success rate of 0.0%. Repositories ranked D typically provide actionable feedback during code reviews and actively nurture new community contributors.
Maintainers in 10up/safe-svg respond to incoming external pull requests in approximately 0.0 hours on average. Keeping PRs focused on single tasks and ensuring tests pass helps maintainers review faster.
The C-Rank™ system evaluates GitHub projects on a 0–100 scale using real data: PR merge rates, review turnaround time, active maintainer presence, and first-time contributor success. A score of 19.5 places 10up/safe-svg in the D tier.
The external contributor pull request merge rate for 10up/safe-svg is 0.0%, based on public PR activity from non-core contributors.
10up/safe-svg currently has 5 active issue(s) tagged with beginner-friendly labels like "good first issue", "beginner", or "up-for-grabs".
Collaborative maintainer environment in 10up/safe-svg. Reviews community pull requests with focus on project quality.
Discussions in 10up/safe-svg focus heavily on practical implementation feedback, code formatting standards, and issue reproduction details.
Unlinked PRs without issue context and changes that fail automated test suites face the highest review friction.
Average Response Latency
Tracks hours until a maintainer leaves a review, comment, or PR response.
External Acceptance Rate
Percentage of community pull requests successfully merged into main.
First PR Conversion
Rate at which developers submitting their first repository PR succeed.
Show contributors that your repository actively reviews and merges external pull requests.
[](https://getmerged.abhishekco.de/10up/safe-svg?utm_source=github&utm_medium=badge)
Historical health & responsiveness evolution
External PR acceptance
First PR success rate
50% receive response in
90% receive response in
Maintainer review activity heatmap & prime window prediction
Calculating local time...
Calculating local time...
Detected: UTC
Maintainers are most responsive around 03:00 UTC (03:00 UTC in your timezone). Recommended submission window is Monday - Wednesday from 02:00 to 06:00 UTC (02:00 - 06:00 UTC local).
Maintainer Strategy: Maintainer Sweet Spot: PRs under 150 lines merge in ~16 hours (81% approval). Large PRs (>500 lines) take ~115 hours (29% approval). Keep your diff compact for rapid review.
Describe the bug Uploading a file whose name ends in .svg but whose content is not an SVG document causes an uncaught LogicException, producing a PHP fatal error instead of the plugin's own "couldn't be sanitized" message. safe_svg::sanitize() handles the sanitizer returning false, but not the sanitizer throwing. In enshrined/svg-sanitize 1.0.0, Sanitizer::sanitize() constructs a data\XPath object whose constructor calls handleDefaultNamespace(), and that method throws when the document does not contain exactly one <svg> element. This is reachable through an ordinary mistake by any user allowed to upload SVGs — a renamed file, a failed download saved with the wrong extension, an HTML error page saved as .svg. Expected: the upload is rejected with the existing message — "Sorry, this file couldn't be sanitized so for security reasons wasn't uploaded". Actual: PHP fatal error, upload aborted with no usable feedback. Both wp_handle_upload_prefilter and wp_handle_sideload_prefilter are
Is your enhancement related to a problem? Please describe. Update PHP support to 8.2 through 8.5. using the PHP version support upgrade skill being developed in Fueled/.github#2 to analyze this repo and identify the changes needed. The update should: Raise the minimum supported PHP version to 8.2 Ensure the project supports and is tested through PHP 8.5 Update composer.json, plugin/package metadata, CI workflows, compatibility tooling, static analysis, readmes/docs, and related configuration as applicable Update dependencies where necessary for PHP 8.2–8.5 compatibility Remove or simplify compatibility code that only exists to support PHP versions below 8.2 where appropriate Address PHP 8.2–8.5 deprecations, compatibility issues, or test failures identified by the skill Update relevant documentation to reflect the new supported PHP range Avoid unnecessary refactoring solely to adopt newer PHP syntax. Any larger modernization opportunities identified by the skill can be documente
Describe the bug Update the 10up/cypress-wp-utils package to version 0.7.0. This release includes compatibility fixes for: WordPress 6.9 WordPress 7.0 WordPress 7.1 This update should allow the E2E tests to begin passing again on this repo. Steps to Reproduce N/A Screenshots, screen recording, code snippet No response Environment information No response WordPress information No response Code of Conduct I agree to follow this project's Code of Conduct
Describe the bug SVG inline block, when used in header outputs weird paragraph html artefact (wraps block's above paragraph in another paragraph). This in turn makes block corrupted. Steps to Reproduce open site editor and header Insert some content above (group, paragraph inside, group below) In lower group add svg inline blocks and inspect frontend HTML. See if it is correct (look at group above). Reload and see if block corruption appears in editor Screenshots, screen recording, code snippet No response Environment information No response WordPress information WP 6.9.1 Code of Conduct I agree to follow this project's Code of Conduct
Describe the bug The feature to change the color is not working if the user selects a custom color instead of a preset color. In the frontend a broken custom property is rendered instead of the custom color code: background-color: var(--wp--preset--color--);. Further the inline attibutes for padding are always rendered, evenn if no value is selected. Therefore it renderes en empty css rule: padding-top: ; padding-right: ; padding-bottom: ; padding-left: ; margin-top: ; margin-right: ; margin-bottom: ; margin-left: ;. Steps to Reproduce insert svg icon go to style tab in right editor sidebar in the color section click on background pick custom color insteat of preset color from swatches save post In the backend everything looks fine. The following markup is renderes in the frontend: <div class="safe-svg-inside safe-svg-inline" style="width: 24px; height: 24px; background-color: var(--wp--preset--color--); color: var(--wp--preset--color--); padding-top: ; padding-right: ; padding-botto
Rate what actually matters after opening a pull request here.
Rate your first-hand PR experience (review speed, maintainer responsiveness, and onboarding ease) to help other contributors.
When evaluating whether to contribute to 10up/safe-svg, response velocity and maintainer engagement are crucial. GetMerged continuously tracks pull request trajectories, first-comment latency, and code review rounds to help developers avoid submitting pull requests to backlogged repositories.
Currently, maintainers of 10up/safe-svg acknowledge new external contributions in approximately -. Out of all submitted pull requests from non-core authors in the last 180-day window, 0.0% were successfully merged into the primary branch.
10up/safe-svg has a recorded first-timer success rate of 0.0%. Repositories ranked Risky typically provide actionable feedback during code reviews and actively nurture new community contributors.
The initial maintainer response time averages ~-. Keeping PRs scoped to single concerns and ensuring CI checks succeed will optimize review turnaround.
The C-Rank™ index scores repositories on a 0 to 100 scale using an objective formula: external PR merge rates, initial response speed, active maintainer count, and first-time contributor retention. A score of 19.5 places 10up/safe-svg in the Risky tier.
The external pull request merge rate is 0.0%. GetMerged isolates non-core community contributions so external developers get an accurate benchmark of PR acceptance probability.
Yes, 10up/safe-svg currently has 5 active issue(s) tagged with beginner-friendly labels. You can inspect these directly from the repository issues tab.
All metrics displayed for 10up/safe-svg are automatically retrieved via the public GitHub API and recalculated daily. Insider pull requests submitted by repository owners or organization members are excluded from merge rate calculations to preserve objective external contributor statistics.