Vulnerabilities and security researches forsunshine-photo-cart sunshine-photo-cart
Direction: ascendingJun 06, 2024
Sunshine Photo Cart: Free Client Galleries for Photographers # CVE-2022-40692
- CVE, Research URL
- Date
- Feb 03, 2023
- Research Description
- Cross-Site Request Forgery (CSRF) vulnerability in WP Sunshine Sunshine Photo Cart plugin <= 2.9.13 versions.
- Affected versions
-
max 2.9.14.
- Status
-
vulnerable
Sunshine Photo Cart: Free Client Galleries for Photographers # ac676046c1581afa4513a53255101425bd4a7404
- CVE, Research URL
- Date
- Jun 21, 2021
- Research Description
- Sunshine Photo Cart – Client Photo Gallery & Photo Proofing for Photographers [sunshine-photo-cart] < 2.8.29 WordPress Sunshine Photo Cart plugin <= 2.8.28 - Cross-Site Request Forgery (CSRF) vulnerability Cross-Site Request Forgery (CSRF) vulnerability discovered by Jerome Bruandet (NinTechNet) in WordPress Sunshine Photo Cart plugin (versions <= 2.8.28).
- Affected versions
-
max 2.8.29.
- Status
-
vulnerable
Sunshine Photo Cart: Free Client Galleries for Photographers # CVE-2022-4301
- CVE, Research URL
- Date
- Jan 10, 2023
- Research Description
- The Sunshine Photo Cart WordPress plugin before 2.9.15 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting.
- Affected versions
-
max 2.9.15.
- Status
-
vulnerable
Sunshine Photo Cart: Free Client Galleries for Photographers # CVE-2024-1294
- CVE, Research URL
- Date
- Feb 29, 2024
- Research Description
- The Sunshine Photo Cart: Free Client Galleries for Photographers plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 3.0.24 via the 'invoice'. This makes it possible for unauthenticated attackers to extract sensitive data including customer email and physical addresses.
- Affected versions
-
max 3.1.
- Status
-
vulnerable
Sunshine Photo Cart: Free Client Galleries for Photographers # CVE-2021-4415
- CVE, Research URL
- Date
- Jul 12, 2023
- Research Description
- The Sunshine Photo Cart plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 2.8.28 This is due to missing or incorrect nonce validation on the sunshine_products_quicksave_post() function. This makes it possible for unauthenticated attackers to save custom post data via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.
- Affected versions
-
max 2.8.29.
- Status
-
vulnerable
Sunshine Photo Cart: Free Client Galleries for Photographers # CVE-2023-41796
- CVE, Research URL
- Date
- Dec 20, 2023
- Research Description
- Authorization Bypass Through User-Controlled Key vulnerability in WP Sunshine Sunshine Photo Cart: Free Client Galleries for Photographers.This issue affects Sunshine Photo Cart: Free Client Galleries for Photographers: from n/a before 3.0.0.
- Affected versions
-
max 3.0.0.
- Status
-
vulnerable
Sunshine Photo Cart: Free Client Galleries for Photographers # CVE-2024-30194
- CVE, Research URL
- Date
- Mar 27, 2024
- Research Description
- Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in sunshinephotocart Sunshine Photo Cart sunshine-photo-cart.This issue affects Sunshine Photo Cart: from n/a through <= 3.1.1.
- Affected versions
-
max 3.1.2.
- Status
-
vulnerable
Sunshine Photo Cart: Free Client Galleries for Photographers # CVE-2024-30221
- CVE, Research URL
- Date
- Mar 28, 2024
- Research Description
- Deserialization of Untrusted Data vulnerability in sunshinephotocart Sunshine Photo Cart sunshine-photo-cart.This issue affects Sunshine Photo Cart: from n/a through <= 3.1.1.
- Affected versions
-
max 3.1.2.
- Status
-
vulnerable
Jun 10, 2024
Sunshine Photo Cart: Free Client Galleries for Photographers # CVE-2022-45826
- CVE, Research URL
- Date
- Dec 13, 2024
- Research Description
- Missing Authorization vulnerability in WP Sunshine Sunshine Photo Cart allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Sunshine Photo Cart: from n/a through 2.9.13.
- Affected versions
-
max 2.9.14.
- Status
-
vulnerable
Aug 12, 2024
Sunshine Photo Cart: Free Client Galleries for Photographers # CVE-2024-43136
- CVE, Research URL
- Date
- Nov 01, 2024
- Research Description
- Missing Authorization vulnerability in sunshinephotocart Sunshine Photo Cart sunshine-photo-cart.This issue affects Sunshine Photo Cart: from n/a through <= 3.2.1.
- Affected versions
-
max 3.2.2.
- Status
-
vulnerable
Sep 01, 2024
Sunshine Photo Cart: Free Client Galleries for Photographers # CVE-2024-43971
- CVE, Research URL
- Date
- Sep 18, 2024
- Research Description
- Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in sunshinephotocart Sunshine Photo Cart sunshine-photo-cart.This issue affects Sunshine Photo Cart: from n/a through <= 3.2.5.
- Affected versions
-
max 3.2.6.
- Status
-
vulnerable
Sep 28, 2024
Sunshine Photo Cart: Free Client Galleries for Photographers # CVE-2024-44038
- CVE, Research URL
- Date
- Nov 01, 2024
- Research Description
- Missing Authorization vulnerability in sunshinephotocart Sunshine Photo Cart sunshine-photo-cart allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Sunshine Photo Cart: from n/a through <= 3.2.9.
- Affected versions
-
max 3.2.10.
- Status
-
vulnerable
Sep 29, 2024
Sunshine Photo Cart: Free Client Galleries for Photographers # CVE-2024-47314
- CVE, Research URL
- Date
- Nov 01, 2024
- Research Description
- Missing Authorization vulnerability in sunshinephotocart Sunshine Photo Cart sunshine-photo-cart allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Sunshine Photo Cart: from n/a through <= 3.2.8.
- Affected versions
-
max 3.2.9.
- Status
-
vulnerable
Oct 25, 2024
Sunshine Photo Cart: Free Client Galleries for Photographers # CVE-2024-49697
- CVE, Research URL
- Date
- Nov 19, 2024
- Research Description
- Missing Authorization vulnerability in sunshinephotocart Sunshine Photo Cart sunshine-photo-cart allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Sunshine Photo Cart: from n/a through <= 3.2.9.
- Affected versions
-
max 3.2.10.
- Status
-
vulnerable
Oct 27, 2024
Sunshine Photo Cart: Free Client Galleries for Photographers # CVE-2024-50463
- CVE, Research URL
- Date
- Oct 28, 2024
- Research Description
- URL Redirection to Untrusted Site ('Open Redirect') vulnerability in sunshinephotocart Sunshine Photo Cart sunshine-photo-cart.This issue affects Sunshine Photo Cart: from n/a through <= 3.2.9.
- Affected versions
-
max 3.2.11.
- Status
-
vulnerable
Apr 02, 2025
Sunshine Photo Cart: Free Client Galleries for Photographers # CVE-2025-31084
- CVE, Research URL
- Date
- Apr 01, 2025
- Research Description
- Deserialization of Untrusted Data vulnerability in sunshinephotocart Sunshine Photo Cart sunshine-photo-cart allows Object Injection.This issue affects Sunshine Photo Cart: from n/a through <= 3.4.10.
- Affected versions
-
max 3.4.11.
- Status
-
vulnerable
Jun 13, 2025
Sunshine Photo Cart: Free Client Galleries for Photographers # CVE-2025-5482
- CVE, Research URL
- Date
- Jun 04, 2025
- Research Description
- The Sunshine Photo Cart: Free Client Photo Galleries for Photographers plugin for WordPress is vulnerable to privilege escalation via account takeover in all versions up to, and including, 3.4.11. This is due to the plugin not properly validating a user-supplied key. This makes it possible for authenticated attackers, with Subscriber-level access and above, to change arbitrary user's passwords through the password reset functionality, including administrators, and leverage that to reset the user's password and gain access to their account.
- Affected versions
-
max 3.4.12.
- Status
-
vulnerable
Nov 10, 2025
Sunshine Photo Cart: Free Client Galleries for Photographers # CVE-2025-62892
- CVE, Research URL
- Date
- Oct 27, 2025
- Research Description
- Missing Authorization vulnerability in sunshinephotocart Sunshine Photo Cart sunshine-photo-cart allows Accessing Functionality Not Properly Constrained by ACLs.This issue affects Sunshine Photo Cart: from n/a through <= 3.5.3.
- Affected versions
-
max 3.5.4.
- Status
-
vulnerable
Jan 10, 2026
Sunshine Photo Cart: Free Client Galleries for Photographers # CVE-2025-68535
- CVE, Research URL
- Date
- Dec 24, 2025
- Research Description
- Missing Authorization vulnerability in sunshinephotocart Sunshine Photo Cart sunshine-photo-cart allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Sunshine Photo Cart: from n/a through <= 3.5.7.1.
- Affected versions
-
max 3.5.7.2.
- Status
-
vulnerable
Feb 28, 2026
Sunshine Photo Cart: Free Client Galleries for Photographers # CVE-2026-24994
- CVE, Research URL
- Date
- Feb 03, 2026
- Research Description
- Missing Authorization vulnerability in sunshinephotocart Sunshine Photo Cart sunshine-photo-cart allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Sunshine Photo Cart: from n/a through <= 3.5.7.2.
- Affected versions
-
max 3.5.7.3.
- Status
-
vulnerable
Sunshine Photo Cart: Free Client Galleries for Photographers # CVE-2025-67973
- CVE, Research URL
- Date
- Feb 20, 2026
- Research Description
- Missing Authorization vulnerability in sunshinephotocart Sunshine Photo Cart sunshine-photo-cart allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Sunshine Photo Cart: from n/a through <= 3.5.6.2.
- Affected versions
-
max 3.5.7.1.
- Status
-
vulnerable
Apr 14, 2026
Sunshine Photo Cart: Free Client Galleries for Photographers # CVE-2026-39564
- CVE, Research URL
- Date
- Apr 08, 2026
- Research Description
- Insertion of Sensitive Information Into Sent Data vulnerability in sunshinephotocart Sunshine Photo Cart sunshine-photo-cart allows Retrieve Embedded Sensitive Data.This issue affects Sunshine Photo Cart: from n/a through < 3.6.2.
- Affected versions
-
max 3.6.2.
- Status
-
vulnerable
May 28, 2026
Sunshine Photo Cart: Free Client Galleries for Photographers # CVE-2026-42776
- CVE, Research URL
- Date
- May 26, 2026
- Research Description
- Missing Authorization vulnerability in WP Sunshine Sunshine Photo Cart allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects Sunshine Photo Cart: from n/a through 3.6.7.
- Affected versions
-
max 3.6.8.
- Status
-
vulnerable
Jun 16, 2026
Sunshine Photo Cart: Free Client Galleries for Photographers # 24571e8a214742ac3ff69eaa9cd19e0cbd649160
- CVE, Research URL
- Date
- -
- Research Description
- Sunshine Photo Cart – Client Photo Gallery & Photo Proofing for Photographers [sunshine-photo-cart] < 2.9.14 WordPress Sunshine Photo Cart Plugin <= 2.9.13 is vulnerable to Cross Site Request Forgery (CSRF) Update the WordPress Sunshine Photo Cart plugin to the latest available version (at least 2.9.14). Lana Codes discovered and reported this Cross Site Request Forgery (CSRF) vulnerability in WordPress Sunshine Photo Cart Plugin. This could allow a malicious actor to force higher privileged users to execute unwanted actions under their current authentication. For example a password change which will then allow the malicious actor to login into the admin account. This vulnerability has been fixed in version 2.9.14.
- Affected versions
-
max 2.9.14.
- Status
-
vulnerable
Sunshine Photo Cart: Free Client Galleries for Photographers # 2907e4d432d18afa79e1d8436b6070f205293c68
- CVE, Research URL
- Date
- -
- Research Description
- Sunshine Photo Cart – Client Photo Gallery & Photo Proofing for Photographers [sunshine-photo-cart] < 2.9.14 WordPress Sunshine Photo Cart Plugin <= 2.9.13 is vulnerable to Broken Access Control Update the WordPress Sunshine Photo Cart plugin to the latest available version (at least 2.9.14). Lana Codes discovered and reported this Broken Access Control vulnerability in WordPress Sunshine Photo Cart Plugin. This vulnerability has been fixed in version 2.9.14.
- Affected versions
-
max 2.9.14.
- Status
-
vulnerable
Sunshine Photo Cart: Free Client Galleries for Photographers # e03420c55099714ac90da016761d318e5e1cb6db
- CVE, Research URL
- Date
- -
- Research Description
- Sunshine Photo Cart – Client Photo Gallery & Photo Proofing for Photographers [sunshine-photo-cart] < 2.8.29 404 Page Not Found
- Affected versions
-
max 2.8.29.
- Status
-
vulnerable
Sunshine Photo Cart: Free Client Galleries for Photographers # 3725296b-c316-440a-875a-3068fb876b3b
- CVE, Research URL
- Date
- -
- Research Description
- Sunshine Photo Cart – Client Photo Gallery & Photo Proofing for Photographers [sunshine-photo-cart] < 2.8.29 CSRF Bypass in Multiple Plugins Multiple plugins are affected by CSRF bypass as they do not properly check for the nonce due to a logic flaw. This could allow attackers to make logged in users do unwanted actions
- Affected versions
-
max 2.8.29.
- Status
-
vulnerable
Jul 29, 2026
Sunshine Photo Cart: Free Client Galleries for Photographers # CVE-2026-57703
- CVE, Research URL
- Date
- Jul 23, 2026
- Research Description
- Subscriber Broken Access Control in Sunshine Photo Cart <= 3.6.10.1 versions.
- Affected versions
-
max 3.6.11.
- Status
-
vulnerable
Aug 07, 2026
Sunshine Photo Cart: Free Client Galleries for Photographers # CVE-2026-16561
- CVE, Research URL
- Date
- Aug 05, 2026
- Research Description
- The Sunshine Photo Cart WordPress plugin before 3.6.12 does not perform access control checks in one of its AJAX actions, allowing unauthenticated users to retrieve the comments of images belonging to private, password-protected or otherwise access-restricted galleries.
- Affected versions
-
max 3.6.12.
- Status
-
vulnerable
Sep 11, 2026
Sunshine Photo Cart: Free Client Galleries for Photographers # CVE-2026-85037
- CVE, Research URL
- Date
- Sep 09, 2026
- Research Description
- The Sunshine Photo Cart WordPress plugin before 3.7 does not validate that a client-supplied price identifier belongs to the item being purchased when it is added to the cart, allowing unauthenticated users to buy items at a lower price defined elsewhere on the site and complete an order at that price, resulting in financial loss for the site owner.
- Affected versions
-
max 3.7.
- Status
-
vulnerable
Sunshine Photo Cart: Free Client Galleries for Photographers # CVE-2022-4463
- CVE, Research URL
-
-
- Date
- Apr 13, 2023
- Research Description
- Rejected reason: This candidate is unused by its CNA.
- Affected versions
-
max 2.9.15.
- Status
-
vulnerable
Oct 07, 2026
Sunshine Photo Cart: Free Client Galleries for Photographers # CVE-2026-93617
- CVE, Research URL
- Date
- Oct 06, 2026
- Research Description
- Deserialization of Untrusted Data vulnerability in WP Sunshine Sunshine Photo Cart sunshine-photo-cart allows Object Injection.This issue affects Sunshine Photo Cart: from n/a through 3.7.1.
- Affected versions
-
max 3.7.2.
- Status
-
vulnerable
Oct 16, 2026
Sunshine Photo Cart: Free Client Galleries for Photographers # CVE-2026-108069
- CVE, Research URL
- Date
- Oct 14, 2026
- Research Description
- The Sunshine Photo Cart WordPress plugin before 3.7.4 does not check whether a visitor is permitted to access a restricted gallery before accepting comment submissions for its images, while it does perform that check when displaying comments, allowing unauthenticated attackers to inject attacker-chosen content with a chosen author name and email into galleries the owner has restricted (password-protected, email-gated, private, account-only or expired).
- Affected versions
-
max 3.7.4.
- Status
-
vulnerable
Oct 25, 2026
Sunshine Photo Cart: Free Client Galleries for Photographers # CVE-2026-111842
- CVE, Research URL
- Date
- Oct 22, 2026
- Research Description
- Missing Authorization vulnerability in WP Sunshine Sunshine Photo Cart sunshine-photo-cart allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Sunshine Photo Cart: from n/a through 3.7.5.
- Affected versions
-
max 3.8.
- Status
-
vulnerable