False Positive - Jetpack Flags Internal Carousel Block Plugin Vulnerability

[Babylon1999]

Jetpack is reporting the carousel plugin as vulnerable on several partner sites, see zd-10568438 and zd-10567265.

Vulnerable Plugin: carousel (version 0.1.1)

I can see it's still not officially added to this repo, but it's being used on the sites mentioned in the tickets above.

• PR: [In progress] Add a Carousel block #49

What's happening:

• The custom Gutenberg block plugin uses the carousel slug, which is also used by another plugin on WordPress.org that genuinely has a vulnerability for all versions < 1.8 (WPScan ref).
• Team51's carousel plugin is way below that version number and, because it shares the same slug, Jetpack is flagging it as vulnerable.

Suggested fix:

• Not sure if it'll introduce other side effects, but updating the plugin slug should do it.