Zalomení
Zalomení has one disclosed vulnerability in the WordSec catalog, all reported in 2025; it remains unpatched as of September 2026. Their average CVSS score is 4.4, and the most serious one scores 4.4 out of 10.
The most common weakness is Cross-Site Scripting, behind 1 of the records (100%).
The one issue recorded for Zalomení has no published fix yet, which makes virtual patching the only reliable mitigation. The oldest unresolved one dates back to 2025.
All of these findings were reported by Taufique Noorani. Zalomení is installed on roughly 6,000 WordPress sites, so each unpatched flaw has a wide blast radius. The current release is tested up to WordPress 7.1.
CVE-2024-12872Zalomení <= 1.5 - Authenticated (Admin+) Stored Cross-Site Scripting
Read the full analysisVulnerability Records

Zalomení
Author
Karolina Vyskocilova
Zalomení is a WordPress plugin that automatically applies Czech typographic rules to post content, titles, comments, and widgets. It replaces ordinary spaces with non-breaking spaces wherever Czech typography forbids a line break, so editors don’t have to type them by hand. Although Czech is the default, the plugin is structured around editable lists of prepositions, conjunctions, and abbreviations — so it can be adapted to Slovak (and other closely related languages) simply by adjusting those lists in the settings. Maintainer Zalomení is maintained by Karolína Vyskočilová, an independent WordPress developer based in Czechia, who took the plugin over in 2026 and ran a full security audit. The plugin was originally created by Honza Skýpala, whose work is gratefully acknowledged. What the plugin handles Prepositions — single-letter prepositions like k, s, v, z must not appear at the end of a line. Conjunctions — single-letter conjunctions like a, i, o, u. Abbreviations — common Czech abbreviations (e.g. např., tj., tzv.). Numbers and units — prevents breaks between a number and its unit (e.g. 5 kg, 10 Kč). Number formatting — keeps formatted numbers together (e.g. phone numbers like 800 123 456). Ordinal numbers — prevents breaks after ordinals, especially in dates (e.g. 1. ledna). Scales and ratios — keeps expressions like 1 : 50 000 on one line. Custom terms — user-defined multi-word terms that should never be broken across lines. All options are configurable under Settings → Reading. The plugin exposes a zalomeni_filtry filter so developers can add or remove the WordPress hooks Zalomení applies to. For more information on Czech typographic rules, see the Institute of the Czech Language.
Vulnerability data © Defiant, Inc., provided under the Wordfence Intelligence T&C