Greek Multi Tool
Greek Multi Tool has 2 disclosed vulnerabilities in the WordSec catalog, all reported in 2025; all 2 are fixed as of October 2026. Their average CVSS score is 6.3, and the most serious one scores 7.2 out of 10. Severity breakdown: 0 critical and 1 high. 2025 was the busiest year with 2 disclosures.
The most common weakness is Cross-Site Scripting, behind 1 of the records (50%). Other recurring categories include Missing Authorization.
Every one of the 2 issues recorded for Greek Multi Tool has a vendor fix available, so running the current release closes all known holes.
All of these findings were reported by Trương Hữu Phúc (truonghuuphuc). Greek Multi Tool is installed on roughly 1,000 WordPress sites, so each unpatched flaw has a wide blast radius. The current release is tested up to WordPress 7.1.3.
Greek Multi Tool <= 2.3.1 - Unauthenticated Stored Cross-Site Scripting
Read the full analysisVulnerability Records

Greek Multi Tool
Author
bigdrop.gr
Greek Multi Tool does a small number of things that a Greek WordPress site needs and WordPress itself does not do, and it does them with the official Greek transliteration standard. Greek permalinks New posts, pages, custom post types, terms and attachments get Latin permalinks as they are created: Οι καλύτερες ιδέες becomes /oi-kalyteres-idees/ instead of /%ce%bf%ce%b9-.... Choose the standard: ELOT 743 (default for new installations): the official Greek transliteration standard (ELOT 743:2001, identical to ISO 843:1997), the one used in passports and road signs, as adopted by the United Nations. μπλούζα → blouza, αυτοκίνητο → aftokinito, σύγχρονος → synchronos. Phonetic: closer to pronunciation (αι → e, ει/οι → i, μπ → b). 3.x compatibility: existing installations keep exactly the permalinks version 3.x produced (μπλούζα → mplouza). It is offered only while it is selected, so you can switch to ELOT 743 whenever you want; existing permalinks never change by themselves. Optionally remove one- and two-letter words from permalinks (numbers are never removed) and keep a list of excluded words, matched regardless of accents and letter case. Media file names Uploaded files with Greek names get Latin names with the same standard: φωτογραφία.jpg → fotografia.jpg. Files that are already uploaded are not renamed. Convert old permalinks, with 301 redirects Content published before the plugin keeps its Greek permalinks until you convert it. The converter: shows a preview first (counts per content type, a sample of old and new URLs, how many will need a numeric suffix) and writes nothing until you confirm you have a backup, works in batches, so it is safe on large sites; an interrupted run can be continued or discarded, and what was converted until then can still be undone, changes only the slug: content, dates and revisions are untouched (no revision is created), keeps the new slug unique and lets WordPress remember the old one as well, records a 301 redirect for every old URL, including child pages and child terms whose URL changed because their parent did. Redirects are always recorded; the “301 redirects” switch only decides whether they are served, can be undone: the previous permalinks come back and the Latin addresses redirect to them (posts through WordPress’ own old-slug redirect, pages, other hierarchical content and terms through redirects the undo records). It is also available in WP-CLI. Redirects are served only for requests WordPress cannot resolve itself (404s, and feeds of addresses that no longer exist), so a live page is never hijacked. The query string of the old address is carried over. They follow the post or term, so they keep working even if you change the permalink structure later, and they cover paginated and feed URLs of the old address. Check them for missing destinations, chains and loops, edit or delete them, export and import CSV. A term whose Greek slug is changed by hand in wp-admin gets a redirect too, while saving a term or a post without touching its slug keeps the slug as it is, even when it is still Greek. Old Greek addresses of categories and tags that versions 2.x and 3.x converted (they only worked through on-the-fly transliteration) are found and redirected. Accent check A panel in the editor sidebar (and a meta box in the classic editor) points out words whose accent is probably wrong: multi-syllable words without an accent, monosyllables with one, accented capitals, interrogative πού/πώς, and more. Greek readiness in Site Health Checks that show up in Tools → Site Health, and in a card on the plugin screen: the site language is Greek when the content is, the theme declares lang="el" on the page (browsers then drop accents on capitals and screen readers use the right language), the database collation ignores accents in search (verified with a real query, never changed by the plugin), how many posts, terms and media files still have Greek names, whether any redirect is broken. Category menus Build a navigation menu that follows your category tree: choose the source (post categories, or WooCommerce product categories when WooCommerce is active), give the menu a name, and the plugin creates a WordPress menu with the same hierarchy, ready in Appearance → Menus. Added or moved categories? Build it again with the same name and the “replace” option, and the menu is rebuilt in place. Hooks and WP-CLI Filters: grmlt_convertible_post_types, grmlt_convertible_taxonomies, grmlt_conversion_batch_size, grmlt_render_shortcodes_on_frontend, grmlt_settings_tabs. Actions: grmlt_post_slug_converted( $post_id, $old, $new ), grmlt_term_slug_converted( $term_id, $taxonomy, $old, $new ), grmlt_conversion_finished( $state ), grmlt_settings_tab_{$id}. Functions for themes: grmlt_slugify( $text, $args ), grmlt_transliterate_greek( $text ). WP-CLI: wp grmlt convert [--dry-run], wp grmlt undo-conversion, wp grmlt redirects check|export|import, wp grmlt acf-restore-keys [--write] [--regenerate-keys] [--undo=<file>].
Vulnerability data © Defiant, Inc., provided under the Wordfence Intelligence T&C