Caret Inc. vulnerabilities

Products

• caret 3
• Caret Country Access Limit 1

Latest Caret Inc. CVEs

Newest publication first

1. CVE-2023-45641 WordPress Caret Country Access Limit Plugin <= 1.0.2 is vulnerable to Cross Site Request Forgery (CSRF)

   Published 2023-10-16

   High·CVSS 8.8 EPSS 0.25%

   Cross-Site Request Forgery (CSRF) vulnerability in Caret Inc. Caret Country Access Limit plugin <= 1.0.2 versions.

2. CVE-2022-42967 XSS in Caret markdown editor leads to remote code execution when viewing crafted Markdown files

   Published 2023-01-11

   Critical·CVSS 9.6 EPSS 0.90%

   Caret is vulnerable to an XSS attack when the user opens a crafted Markdown file when preview mode is enabled. This directly leads to client-side code execution.

3. CVE-2020-20269 A specially crafted Markdown document could cause the execution of malicious JavaScript code in Caret Editor before 4.0.0-rc22.

   Published 2021-01-22

   Critical·CVSS 9.8 EPSS 4.9%

   A specially crafted Markdown document could cause the execution of malicious JavaScript code in Caret Editor before 4.0.0-rc22.

4. CVE-2019-9927 Caret before 2019-02-22 allows Remote Code Execution.

   Published 2019-03-22

   Critical·CVSS 9.8 EPSS 3.6%

   Caret before 2019-02-22 allows Remote Code Execution.

Sources: CVE.org, NVD, CISA KEV, FIRST EPSS, OSV and public exploit-reference metadata. Product matching comes from the published CVE records. A proof-of-concept means public code exists; it is not evidence of exploitation.