sunshinephotocart

Records27All Threatist records

Exploited (KEV)0None in CISA KEV

CVSS critical4CVSS 9.0–10.0

CVSS high7CVSS 7.0–8.9

Exploited now

sunshinephotocart records in CISA KEV

No sunshinephotocart vulnerabilities are listed in CISA KEV.

Components

Products in the NVD configurations · select one to filter the records

Sunshine Photo Cart 16 records MEDIUM

Records

16 records in Sunshine Photo Cart · all components

TI-2022-03939 CVE-2022-4301 · GHSA-cppm-xp38-fh2x

Sunshine Photo Cart < 2.9.15 - Reflected XSS

MEDIUM 60

The Sunshine Photo Cart WordPress plugin before 2.9.15 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting.

CVSS 3.1MEDIUM 6.1 Network No auth User interaction EPSS 0.00912 Published 2023-01-09 Fixed in 2.9.15

TI-2025-22354 CVE-2025-31084 · GHSA-3vmq-cr85-65gq

WordPress Sunshine Photo Cart plugin <= 3.4.10 - PHP Object Injection Vulnerability

MEDIUM 50

Deserialization of Untrusted Data vulnerability in sunshinephotocart Sunshine Photo Cart sunshine-photo-cart allows Object Injection.This issue affects Sunshine Photo Cart: from n/a through <= 3.4.10.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.00731 Published 2025-04-01 No fix listed CWE-502

TI-2024-29627 CVE-2024-44038 · GHSA-8467-9654-v2mx

WordPress Sunshine Photo Cart plugin <= 3.2.9 - Broken Access Control vulnerability

MEDIUM 48

Missing Authorization vulnerability in sunshinephotocart Sunshine Photo Cart sunshine-photo-cart allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Sunshine Photo Cart: from n/a th…

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.00409 Published 2024-11-01 No fix listed CWE-862

TI-2024-19967 CVE-2024-30221 · GHSA-pr9j-p6wx-p73x

WordPress Sunshine Photo Cart plugin <= 3.1.1 - PHP Object Injection vulnerability

MEDIUM 42

Deserialization of Untrusted Data vulnerability in sunshinephotocart Sunshine Photo Cart sunshine-photo-cart.This issue affects Sunshine Photo Cart: from n/a through <= 3.1.1.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.00465 Published 2024-03-28 No fix listed CWE-502

TI-2025-04923 CVE-2025-5482 · GHSA-3w3h-97p3-6xqh

Sunshine Photo Cart <= 3.4.11 - Authenticated (Subscriber+) Privilege Escalation

MEDIUM 41

The Sunshine Photo Cart: Free Client Photo Galleries for Photographers plugin for WordPress is vulnerable to privilege escalation via account takeover in all versions up to, and including, 3.4.11.

CVSS 3.1HIGH 8.8 Network Low privileges No interaction EPSS 0.0059 Published 2025-06-04 No fix listed CWE-620

TI-2024-31632 CVE-2024-47314 · GHSA-xh75-6m4g-h6hf

WordPress Sunshine Photo Cart plugin <= 3.2.8 - Broken Access Control vulnerability

LOW 38

CVSS 3.1HIGH 8.8 Network Low privileges No interaction EPSS 0.00393 Published 2024-11-01 No fix listed CWE-862

TI-2024-28807 CVE-2024-43136 · GHSA-jf2g-fqpf-2mrq

WordPress Sunshine Photo Cart plugin <= 3.2.1 - Broken Access Control vulnerability

LOW 38

Missing Authorization vulnerability in sunshinephotocart Sunshine Photo Cart sunshine-photo-cart.This issue affects Sunshine Photo Cart: from n/a through <= 3.2.1.

CVSS 3.1HIGH 8.8 Network Low privileges No interaction EPSS 0.00439 Published 2024-11-01 No fix listed CWE-862

TI-2022-19327 CVE-2022-40692 · GHSA-9v2q-q88j-mr44

WordPress Sunshine Photo Cart Plugin <= 2.9.13 is vulnerable to Cross Site Request Forgery (CSRF)

LOW 38

Cross-Site Request Forgery (CSRF) vulnerability in WP Sunshine Sunshine Photo Cart plugin <= 2.9.13 versions.

CVSS 3.1HIGH 8.8 Network No auth User interaction EPSS 0.00264 Published 2023-02-02 No fix listed CWE-352

TI-2023-22196 CVE-2023-41796 · GHSA-2gcq-g27g-mx27

WordPress Sunshine Photo Cart Plugin < 3.0.0 is vulnerable to Insecure Direct Object References (IDOR)

LOW 35

Authorization Bypass Through User-Controlled Key vulnerability in WP Sunshine Sunshine Photo Cart: Free Client Galleries for Photographers.This issue affects Sunshine Photo Cart: Free Client Galleries for Photographers:…

CVSS 3.1MEDIUM 6.5 Network No auth No interaction EPSS 0.00424 Published 2023-12-20 Fixed in 3.0.0 CWE-639

TI-2024-29560 CVE-2024-43971 · GHSA-vj4c-r6hh-429f

WordPress Sunshine Photo Cart plugin <= 3.2.5 - Cross Site Scripting (XSS) vulnerability

LOW 32

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in sunshinephotocart Sunshine Photo Cart sunshine-photo-cart.This issue affects Sunshine Photo Cart: from n/a through <=…

CVSS 3.1HIGH 7.1 Network No auth User interaction EPSS 0.00624 Published 2024-09-17 No fix listed CWE-79

TI-2024-19940 CVE-2024-30194 · GHSA-4gwg-56fg-39pf

WordPress Sunshine Photo Cart plugin <= 3.1.1 - Reflected Cross Site Scripting (XSS) vulnerability

LOW 32

CVSS 3.1HIGH 7.1 Network No auth User interaction EPSS 0.00721 Published 2024-03-27 No fix listed CWE-79

TI-2024-01204 CVE-2024-1294 · GHSA-2jp9-jf92-mxp7

Improper access control in sunshinephotocart Sunshine Photo Cart – Client Photo Gallery &…

LOW 31

The Sunshine Photo Cart: Free Client Galleries for Photographers plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 3.0.24 via the 'invoice'.

CVSS 3.1MEDIUM 5.3 Network No auth No interaction EPSS 0.00678 Published 2024-02-20 No fix listed CWE-284

TI-2024-33895 CVE-2024-50463 · GHSA-q58q-j8gc-gvjh

WordPress Sunshine Photo Cart plugin <= 3.2.9 - Open Redirection vulnerability

LOW 27

URL Redirection to Untrusted Site ('Open Redirect') vulnerability in sunshinephotocart Sunshine Photo Cart sunshine-photo-cart.This issue affects Sunshine Photo Cart: from n/a through <= 3.2.9.

CVSS 3.1MEDIUM 6.1 Network No auth User interaction EPSS 0.00273 Published 2024-10-28 No fix listed CWE-601

TI-2022-22630 CVE-2022-45826 · GHSA-pm7j-cf5m-mq99

WordPress Sunshine Photo Cart plugin <= 2.9.13 - Auth. Broken Access Control vulnerability

LOW 25

Missing Authorization vulnerability in WP Sunshine Sunshine Photo Cart allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Sunshine Photo Cart: from n/a through 2.9.13.

CVSS 3.1MEDIUM 5.4 Network No auth User interaction EPSS 0.0043 Published 2024-12-13 No fix listed CWE-862

TI-2024-33183 CVE-2024-49697 · GHSA-v6rr-j96c-5w92

WordPress Sunshine Photo Cart plugin <= 3.2.9 - Broken Access Control vulnerability

LOW 20

CVSS 3.1MEDIUM 4.3 Network Low privileges No interaction EPSS 0.00415 Published 2024-11-19 No fix listed CWE-862

TI-2021-03272 CVE-2021-4415 · GHSA-jmrg-64rf-qpwj

Sunshine Photo Cart <= 2.8.28 - Cross-Site Request Forgery Bypass

LOW 20

The Sunshine Photo Cart plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 2.8.28 This is due to missing or incorrect nonce validation on the sunshine_products_quicksave_po…

CVSS 3.1MEDIUM 4.3 Network No auth User interaction EPSS 0.00384 Published 2023-07-12 No fix listed CWE-352

Open these records in search →

Critical	4
High	7
Medium	16
Low	0
No CVSS	0