Sunshine Photo Cart
by WordPress
Source repositories
CVEs (24)
| CVE | Vendor / Product | Sev | Risk | CVSS | EPSS | KEV | Published | Description |
|---|---|---|---|---|---|---|---|---|
| CVE-2024-1294 | Med | 0.28 | 5.3 | 0.01 | Feb 29, 2024 | The Sunshine Photo Cart: Free Client Galleries for Photographers plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 3.0.24 via the 'invoice'. This makes it possible for unauthenticated attackers to extract sensitive data… | ||
| CVE-2021-4415 | Med | 0.21 | 4.3 | 0.00 | Jul 12, 2023 | The Sunshine Photo Cart plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 2.8.28 This is due to missing or incorrect nonce validation on the sunshine_products_quicksave_post() function. This makes it possible for unauthenticated… | ||
| CVE-2026-16561 | Hig | 0.00 | 7.5 | 0.00 | Aug 5, 2026 | The Sunshine Photo Cart WordPress plugin before 3.6.12 does not perform access control checks in one of its AJAX actions, allowing unauthenticated users to retrieve the comments of images belonging to private, password-protected or otherwise access-restricted galleries. | ||
| CVE-2026-57703 | Med | 0.00 | 6.3 | 0.00 | Jul 23, 2026 | Subscriber Broken Access Control in Sunshine Photo Cart <= 3.6.10.1 versions. |
- risk 0.28cvss 5.3epss 0.01
The Sunshine Photo Cart: Free Client Galleries for Photographers plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 3.0.24 via the 'invoice'. This makes it possible for unauthenticated attackers to extract sensitive data…
- risk 0.21cvss 4.3epss 0.00
The Sunshine Photo Cart plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 2.8.28 This is due to missing or incorrect nonce validation on the sunshine_products_quicksave_post() function. This makes it possible for unauthenticated…
- risk 0.00cvss 7.5epss 0.00
The Sunshine Photo Cart WordPress plugin before 3.6.12 does not perform access control checks in one of its AJAX actions, allowing unauthenticated users to retrieve the comments of images belonging to private, password-protected or otherwise access-restricted galleries.
- risk 0.00cvss 6.3epss 0.00
Subscriber Broken Access Control in Sunshine Photo Cart <= 3.6.10.1 versions.
Page 2 of 2