Using the "set" tag to add a remote/data/script target to any attribute is blocked. Found <set to="$1"> in the uploaded SVG file.
<set to="$1">
