Cyr to Lat Reloaded – Transliteration of Links and File Names

Cyr to Lat Reloaded – Transliteration of Links and File Names has one disclosed vulnerability in the WordSec catalog, all reported in 2026; it is fixed as of September 2026. Their average CVSS score is 4.3, and the most serious one scores 4.3 out of 10.

The most common weakness is Missing Authorization, behind 1 of the records (100%).

The one issue recorded for Cyr to Lat Reloaded – Transliteration of Links and File Names has a vendor fix available, so running the current release closes it.

All of these findings were reported by Ananda Dhakal. Cyr to Lat Reloaded – Transliteration of Links and File Names is installed on roughly 30,000 WordPress sites, so each unpatched flaw has a wide blast radius. The current release is tested up to WordPress 7.1.

Strategic Overview

Avg CVSSMedium
4.3/ 10
Patch Coverage100%
Open

0

Fixed

1

Get automatic notifications for all Cyr to Lat Reloaded – Transliteration of Links and File Names vulnerabilities before they are exploited.

Highest severity on recordCVSS 4.3CVE-2026-65537

Cyr to Lat Reloaded – Transliteration of Links and File Names <= 1.3.3 - Missing Authorization

Read the full analysis

Vulnerability Records

1 records
Cyr to Lat Reloaded – Transliteration of Links and File Names banner
Latestv1.3.5

Cyr to Lat Reloaded – Transliteration of Links and File Names

Themeisle

Author

Themeisle

4.4(13)
88/100
Last Updated
2026-08-20 (21d ago)
Active Installs
30,000+
Downloads
244,918
Requires WP
4.2+
Requires PHP
5.2+
Tested up to
WP 7.1
Created
2012-11-29 (14y ago)

Note: This plugin is no longer being actively developed, and we recommend switching to Cyrlitera, a more advanced version with expanded features and customization options. Transliteration is the process of converting characters from one writing system to another, such as converting Cyrillic symbols to Latin. Because most web software and URLs are designed around Latin characters, using Cyrillic or other non-Latin symbols in links or file names can lead to unreadable URLs, accessibility issues, and even broken links. Transliteration ensures your URLs and file names remain clean, readable, and compatible across all platforms. This plugin automatically replaces Cyrillic, Georgian, Turkish, and other supported characters with Latin equivalents to create clean and readable URLs for posts, categories, taxonomies, products, and custom post types. It also fixes incorrect file names by removing unsafe characters and transliterating them during upload, helping prevent 404 errors and broken media links. Examples Cyrillic URL before transliteration: https://example.com/%D0%BF%D1%80%D0%B8%D0%B2%D0%B5%D1%82-%D0%BC%D0%B8%D1%80 Same URL transliterated to Latin: https://example.com/privet-mir Incorrect file names before transliteration: %D0%BC%D0%BE%D0%B5_image_290.jpg A+nice+picture.png Readable transliterated file names: moe_image_290.jpg a-nice-picture.png By using Latin-based file names and URLs, you avoid issues with encoding, broken links, and unreadable paths. This plugin performs the transliteration automatically each time a file is uploaded, ensuring your media library stays clean and consistent. Features Automatically transliterates URLs for posts, pages, categories, tags, and custom post types Preserves existing URL structure while making it readable Transliterates attachment file names Removes unsafe or problematic characters from file names Supports Russian, Belarusian, Ukrainian, Bulgarian, Georgian, Greek, Armenian, and Serbian character sets Compatible with Advanced Custom Fields, Asgaros Forum, and BuddyPress Advanced Transliteration Features If you need more advanced transliteration features, consider upgrading to Cyrlitera. Unlike Cyr to Lat Reloaded, Cyrlitera offers a user-friendly interface that gives you full control over how links are transliterated. It also allows you to roll back converted URLs, create automatic redirects from old URLs to new ones, and help eliminate broken links across your site.

Vulnerability data © Defiant, Inc., provided under the Wordfence Intelligence T&C