Critical SQL Injection in Serbian Transliteration Plugin

WordPress

What happened

There is an unauthenticated SQL injection vulnerability in the Serbian Transliteration plugin for WordPress versions up to 2.5.13. This issue can potentially allow an attacker to manipulate database queries.

Are you affected?

The Serbian Transliteration plugin for WordPress, specifically versions up to 2.5.13, may be affected.

What to do now

1. Upgrade to the latest version of the Serbian Transliteration plugin as soon as possible.
2. Review your database logs for any unusual activity.
3. Check the official advisory for more guidance.

Sources

• cve.now/CVE-2026-39732
• cve.now/GHSA-cf3x-m635-98vh
• CVE-2026-39732
• GHSA-cf3x-m635-98vh
• https://nvd.nist.gov/vuln/detail/CVE-2026-39732
• https://patchstack.com/database/wordpress/plugin/serbian-transliteration/vulnerability/wordpress-transliterator-plugin-2-5-13-sql-injection-vulnerability?_s_id=cve

Data sources: cve.now, CISA KEV, GitHub Advisory Database, OSV.

This product uses data from the NVD API but is not endorsed or certified by the NVD.