WordPress plugin
Carta Online security & vulnerabilities
No known unpatched vulnerabilities in the latest version
All 1 known vulnerability is fixed in the latest release. If you run an older version, update to null or newer.
- Critical0
- High0
- Medium1
- Low0
All Carta Online vulnerabilities
| Severity | Vulnerability | CVE | Published |
|---|---|---|---|
| Medium4.4 | Authenticated (Administrator+) Stored Cross-Site Scripting via Plugin Settings ≤2.13.0Update to 2.15.0 | CVE-2026-1071 |
- Medium4.4Authenticated (Administrator+) Stored Cross-Site Scripting via Plugin Settings
≤2.13.0Update to 2.15.0
Carta Online: common questions
Does Carta Online have known vulnerabilities?
Yes. VulnCrest Radar lists 1 known vulnerability in Carta Online: 1 medium. None are known to affect version null.
How do I check which version of Carta Online I run?
In wp-admin open Plugins → Installed Plugins; the version is shown under the name. Without admin access, our passive Check my site tool can often read it from public files.
What is the most recent Carta Online vulnerability?
CVE-2026-1071, published Mar 6, 2026: Carta Online <= 2.13.0 - Authenticated (Administrator+) Stored Cross-Site Scripting via Plugin Settings. Severity: Medium (CVSS 4.4).
Is any Carta Online vulnerability listed in CISA KEV?
No. None of the known Carta Online vulnerabilities is currently listed in the CISA KEV catalog.