Read the docs

Vulnerabilities

Filters

Reset all
Threatist priority
Signals
Fix status
Impact type
Attack vector
Requirements
Product

Products as named in CPE, with their records.

Published
Weakness (CWE)
2 selected

16 records

Vendor: sunshinephotocart Component: Sunshine Photo Cart Clear all filters
TI-2025-04923 CVE-2025-5482 · GHSA-3w3h-97p3-6xqh

Sunshine Photo Cart <= 3.4.11 - Authenticated (Subscriber+) Privilege Escalation

Priority MEDIUM 41

The Sunshine Photo Cart: Free Client Photo Galleries for Photographers plugin for WordPress is vulnerable to privilege escalation via account takeover in all versions up to, and including, 3.4.11.

CVSS 3.1HIGH 8.8 Network Low privileges No interaction EPSS 0.0059 Published 2025-06-04 No fix listed CWE-620
TI-2024-33183 CVE-2024-49697 · GHSA-v6rr-j96c-5w92

WordPress Sunshine Photo Cart plugin <= 3.2.9 - Broken Access Control vulnerability

Priority LOW 20

Missing Authorization vulnerability in sunshinephotocart Sunshine Photo Cart sunshine-photo-cart allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Sunshine Photo Cart: from n/a th…

CVSS 3.1MEDIUM 4.3 Network Low privileges No interaction EPSS 0.00415 Published 2024-11-19 No fix listed CWE-862
TI-2024-31632 CVE-2024-47314 · GHSA-xh75-6m4g-h6hf

WordPress Sunshine Photo Cart plugin <= 3.2.8 - Broken Access Control vulnerability

Priority LOW 38

Missing Authorization vulnerability in sunshinephotocart Sunshine Photo Cart sunshine-photo-cart allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Sunshine Photo Cart: from n/a th…

CVSS 3.1HIGH 8.8 Network Low privileges No interaction EPSS 0.00393 Published 2024-11-01 No fix listed CWE-862
TI-2024-29627 CVE-2024-44038 · GHSA-8467-9654-v2mx

WordPress Sunshine Photo Cart plugin <= 3.2.9 - Broken Access Control vulnerability

Priority MEDIUM 48

Missing Authorization vulnerability in sunshinephotocart Sunshine Photo Cart sunshine-photo-cart allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Sunshine Photo Cart: from n/a th…

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.00409 Published 2024-11-01 No fix listed CWE-862
TI-2024-33895 CVE-2024-50463 · GHSA-q58q-j8gc-gvjh

WordPress Sunshine Photo Cart plugin <= 3.2.9 - Open Redirection vulnerability

Priority LOW 27

URL Redirection to Untrusted Site ('Open Redirect') vulnerability in sunshinephotocart Sunshine Photo Cart sunshine-photo-cart.This issue affects Sunshine Photo Cart: from n/a through <= 3.2.9.

CVSS 3.1MEDIUM 6.1 Network No auth User interaction EPSS 0.00273 Published 2024-10-28 No fix listed CWE-601
TI-2024-19940 CVE-2024-30194 · GHSA-4gwg-56fg-39pf

WordPress Sunshine Photo Cart plugin <= 3.1.1 - Reflected Cross Site Scripting (XSS) vulnerability

Priority LOW 32

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in sunshinephotocart Sunshine Photo Cart sunshine-photo-cart.This issue affects Sunshine Photo Cart: from n/a through <=…

CVSS 3.1HIGH 7.1 Network No auth User interaction EPSS 0.00721 Published 2024-03-27 No fix listed CWE-79
TI-2023-22196 CVE-2023-41796 · GHSA-2gcq-g27g-mx27

WordPress Sunshine Photo Cart Plugin < 3.0.0 is vulnerable to Insecure Direct Object References (IDOR)

Priority LOW 35

Authorization Bypass Through User-Controlled Key vulnerability in WP Sunshine Sunshine Photo Cart: Free Client Galleries for Photographers.This issue affects Sunshine Photo Cart: Free Client Galleries for Photographers:…

CVSS 3.1MEDIUM 6.5 Network No auth No interaction EPSS 0.00424 Published 2023-12-20 Fixed in 3.0.0 CWE-639
TI-2021-03272 CVE-2021-4415 · GHSA-jmrg-64rf-qpwj

Sunshine Photo Cart <= 2.8.28 - Cross-Site Request Forgery Bypass

Priority LOW 20

The Sunshine Photo Cart plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 2.8.28 This is due to missing or incorrect nonce validation on the sunshine_products_quicksave_po…

CVSS 3.1MEDIUM 4.3 Network No auth User interaction EPSS 0.00384 Published 2023-07-12 No fix listed CWE-352
TI-2022-03939 CVE-2022-4301 · GHSA-cppm-xp38-fh2x

Sunshine Photo Cart < 2.9.15 - Reflected XSS

Priority MEDIUM 60

The Sunshine Photo Cart WordPress plugin before 2.9.15 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting.

CVSS 3.1MEDIUM 6.1 Network No auth User interaction EPSS 0.00912 Published 2023-01-09 Fixed in 2.9.15