Vulnerabilities

TI-2023-24442 CVE-2023-45641 · GHSA-p78w-ghp7-m4p3

WordPress Caret Country Access Limit Plugin <= 1.0.2 is vulnerable to Cross Site Request Forgery (CSRF)

LOW 38

Cross-Site Request Forgery (CSRF) vulnerability in Caret Inc.

CVSS 3.1HIGH 8.8 Network No auth User interaction EPSS 0.00252 Published 2023-10-16 No fix listed CWE-352

TI-2022-20947 CVE-2022-42967 · GHSA-9852-mg56-6j5x

HIGH 76

Caret is vulnerable to an XSS attack when the user opens a crafted Markdown file when preview mode is enabled.

CVSS 3.1CRITICAL 9.6 Network No auth User interaction EPSS 0.00863 Published 2023-01-11 No fix listed CWE-79

TI-2020-13815 CVE-2020-20269 · GHSA-mjqr-4qcm-8x7g

MEDIUM 50

A specially crafted Markdown document could cause the execution of malicious JavaScript code in Caret Editor before 4.0.0-rc22.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.04887 Published 2021-01-22 No fix listed

TI-2019-07298 CVE-2019-9927 · GHSA-m6g3-4p5c-2968

MEDIUM 48

Caret before 2019-02-22 allows Remote Code Execution.

CVSS 3.0CRITICAL 9.8 Network No auth No interaction EPSS 0.03614 Published 2019-03-22 No fix listed