WordPress security by component

Sunshine Photo Cart

Plugin description

Sunshine Photo Cart creates photography sales galleries with client access, image products, orders, and digital or physical photo purchasing.

Sunshine Photo Cart (sunshine-photo-cart) is a WordPress plugin with 24 published CVE records in this archive. The latest tracked vulnerability was published Aug 05, 2026; the highest published CVSS base score is 9.8.

Plugin slug: sunshine-photo-cart

Latest vulnerability

CVE-2026-16561: Sunshine Photo Cart AJAX access exposes restricted-gallery comments

Sunshine Photo Cart before 3.6.12 exposes an AJAX action without an access-control check. An unauthenticated caller can use it to retrieve comments attached to images in private, password-protected or otherwise restricted galleries. This unscored record received deeper review because it provides an unauthenticated protected-content disclosure primitive. The CNA does not disclose the AJAX action, image identifier parameter or response structure.

PublishedAug 05, 2026

Known safe version3.6.12

Published vulnerabilities for sunshine-photo-cart
		Safe version
Aug 05, 2026	CVE-2026-16561 Sunshine Photo Cart AJAX access exposes restricted-gallery comments Sunshine Photo Cart before 3.6.12 exposes an AJAX action without an access-control check. An unauthenticated caller can use it to retrieve comments attached to images in private, password-protected or otherwise restricted galleries. This unscored record received deeper review because it provides an unauthenticated protected-content disclosure primitive. The CNA does not disclose the AJAX action, image identifier parameter or response structure.	3.6.12	CVE7.5 NVDPending
Jul 23, 2026	CVE-2026-57703 Sunshine Photo Cart: Broken access control Sunshine Photo Cart is affected by broken access control. Exploitation requires an authenticated subscriber account. A successful request can reach data or an operation that should be restricted to another user or a more privileged role. The published affected range is n/a through 3.6.10.1. The public source does not disclose the vulnerable endpoint, action, parameter or function, so the precise input path remains unknown.	3.6.11	CVE6.3 NVDPending
May 25, 2026	CVE-2026-42776 Sunshine Photo Cart: A security weakness Sunshine Photo Cart is affected by a security weakness. Exposure depends on how the affected operation is made reachable by the site. The resulting impact depends on how the affected component exposes the vulnerable operation. The published affected range is n/a through 3.6.7. The public source does not disclose the vulnerable endpoint, action, parameter or function, so the precise input path remains unknown.	3.6.8	CVE6.3 NVDPending
Apr 08, 2026	CVE-2026-39564 Sunshine Photo Cart: A security weakness Sunshine Photo Cart is affected by a security weakness. Exposure depends on how the affected operation is made reachable by the site. The resulting impact depends on how the affected component exposes the vulnerable operation. The published affected range is <= 3.6.2. The public source does not disclose the vulnerable endpoint, action, parameter or function, so the precise input path remains unknown.	3.6.2	CVE5.3 NVDPending
Feb 20, 2026	CVE-2025-67973 Sunshine Photo Cart: A security weakness Sunshine Photo Cart is affected by a security weakness. Exposure depends on how the affected operation is made reachable by the site. The resulting impact depends on how the affected component exposes the vulnerable operation. The public source does not disclose the vulnerable endpoint, action, parameter or function, so the precise input path remains unknown.	See mitigation notes	CVE6.5 NVDPending
Feb 03, 2026	CVE-2026-24994 Sunshine Photo Cart: A security weakness Sunshine Photo Cart is affected by a security weakness. Exposure depends on how the affected operation is made reachable by the site. The resulting impact depends on how the affected component exposes the vulnerable operation. The public source does not disclose the vulnerable endpoint, action, parameter or function, so the precise input path remains unknown.	See mitigation notes	CVE5.3 NVDPending
Dec 24, 2025	CVE-2025-68535 Sunshine Photo Cart: A security weakness Sunshine Photo Cart is affected by a security weakness. Exposure depends on how the affected operation is made reachable by the site. The resulting impact depends on how the affected component exposes the vulnerable operation. The public source does not disclose the vulnerable endpoint, action, parameter or function, so the precise input path remains unknown.	See mitigation notes	CVE4.3 NVDPending
Oct 27, 2025	CVE-2025-62892 Sunshine Photo Cart: A security weakness Sunshine Photo Cart is affected by a security weakness. Exposure depends on how the affected operation is made reachable by the site. The resulting impact depends on how the affected component exposes the vulnerable operation. The public source does not disclose the vulnerable endpoint, action, parameter or function, so the precise input path remains unknown.	See mitigation notes	CVE5.3 NVDPending
Jun 04, 2025	CVE-2025-5482 Sunshine Photo Cart: Free Client Photo Galleries for Photographers: Privilege escalation or authentication bypass Sunshine Photo Cart: Free Client Photo Galleries for Photographers is affected by privilege escalation or authentication bypass. Exploitation requires an authenticated subscriber account. A successful request can grant permissions or access that the caller should not possess. The public source does not disclose the vulnerable endpoint, action, parameter or function, so the precise input path remains unknown.	See mitigation notes	CVE8.8 NVDPending
Apr 01, 2025	CVE-2025-31084 Sunshine Photo Cart: Code execution Sunshine Photo Cart is affected by code execution. Exposure depends on how the affected operation is made reachable by the site. Successful exploitation can run attacker-controlled code in the WordPress hosting account. The public source does not disclose the vulnerable endpoint, action, parameter or function, so the precise input path remains unknown.	See mitigation notes	CVE9.8 NVD9.8
Dec 13, 2024	CVE-2022-45826 Sunshine Photo Cart: A security weakness Sunshine Photo Cart is affected by a security weakness. Exposure depends on how the affected operation is made reachable by the site. The resulting impact depends on how the affected component exposes the vulnerable operation. The public source does not disclose the vulnerable endpoint, action, parameter or function, so the precise input path remains unknown.	See mitigation notes	CVE5.4 NVD5.4
Nov 19, 2024	CVE-2024-49697 Sunshine Photo Cart: A security weakness Sunshine Photo Cart is affected by a security weakness. Exposure depends on how the affected operation is made reachable by the site. The resulting impact depends on how the affected component exposes the vulnerable operation. The public source does not disclose the vulnerable endpoint, action, parameter or function, so the precise input path remains unknown.	See mitigation notes	CVE4.3 NVD4.3
Nov 01, 2024	CVE-2024-47314 Sunshine Photo Cart: A security weakness Sunshine Photo Cart is affected by a security weakness. Exposure depends on how the affected operation is made reachable by the site. The resulting impact depends on how the affected component exposes the vulnerable operation. The public source does not disclose the vulnerable endpoint, action, parameter or function, so the precise input path remains unknown.	See mitigation notes	CVE7.1 NVD8.8
Nov 01, 2024	CVE-2024-44038 Sunshine Photo Cart: A security weakness Sunshine Photo Cart is affected by a security weakness. Exposure depends on how the affected operation is made reachable by the site. The resulting impact depends on how the affected component exposes the vulnerable operation. The public source does not disclose the vulnerable endpoint, action, parameter or function, so the precise input path remains unknown.	See mitigation notes	CVE5.3 NVD9.8
Nov 01, 2024	CVE-2024-43136 Sunshine Photo Cart: A security weakness Sunshine Photo Cart is affected by a security weakness. Exposure depends on how the affected operation is made reachable by the site. The resulting impact depends on how the affected component exposes the vulnerable operation. The public source does not disclose the vulnerable endpoint, action, parameter or function, so the precise input path remains unknown.	See mitigation notes	CVE4.3 NVD8.8
Oct 28, 2024	CVE-2024-50463 Sunshine Photo Cart: An open redirect Sunshine Photo Cart is affected by an open redirect. Exposure depends on how the affected operation is made reachable by the site. A crafted link can redirect visitors from the trusted site to an attacker-controlled destination. The public source does not disclose the vulnerable endpoint, action, parameter or function, so the precise input path remains unknown.	See mitigation notes	CVE4.7 NVD6.1
Sep 18, 2024	CVE-2024-43971 Sunshine Photo Cart: Cross-site scripting Sunshine Photo Cart is affected by cross-site scripting. Exposure depends on how the affected operation is made reachable by the site. Injected script can execute in the affected site's origin when the vulnerable output is viewed. The public source does not disclose the vulnerable endpoint, action, parameter or function, so the precise input path remains unknown.	See mitigation notes	CVE7.1 NVD6.1
Mar 28, 2024	CVE-2024-30221 Sunshine Photo Cart: Code execution Sunshine Photo Cart is affected by code execution. Exposure depends on how the affected operation is made reachable by the site. Successful exploitation can run attacker-controlled code in the WordPress hosting account. The public source does not disclose the vulnerable endpoint, action, parameter or function, so the precise input path remains unknown.	See mitigation notes	CVE5.4 NVD9.8
Mar 27, 2024	CVE-2024-30194 Sunshine Photo Cart: Cross-site scripting Sunshine Photo Cart is affected by cross-site scripting. Exposure depends on how the affected operation is made reachable by the site. Injected script can execute in the affected site's origin when the vulnerable output is viewed. The public source does not disclose the vulnerable endpoint, action, parameter or function, so the precise input path remains unknown.	See mitigation notes	CVE7.1 NVD6.1
Feb 29, 2024	CVE-2024-1294 Sunshine Photo Cart: Free Client Galleries for Photographers: Sensitive information exposure Sunshine Photo Cart: Free Client Galleries for Photographers is affected by sensitive information exposure. The vulnerable path is reachable without authentication. Successful exploitation can disclose data that should not be available to the caller. The public source does not disclose the vulnerable endpoint, action, parameter or function, so the precise input path remains unknown.	See mitigation notes	CVE5.3 NVDPending
Dec 20, 2023	CVE-2023-41796 Sunshine Photo Cart: Free Client Galleries for Photographers: A security weakness Sunshine Photo Cart: Free Client Galleries for Photographers is affected by a security weakness. Exposure depends on how the affected operation is made reachable by the site. The resulting impact depends on how the affected component exposes the vulnerable operation. The public source does not disclose the vulnerable endpoint, action, parameter or function, so the precise input path remains unknown.	See mitigation notes	CVE5.3 NVD6.5
Jul 12, 2023	CVE-2021-4415 Sunshine Photo Cart: Cross-site request forgery Sunshine Photo Cart is affected by cross-site request forgery. The vulnerable path is reachable without authentication. Exploitation relies on a signed-in privileged user submitting an attacker-controlled request. The public source does not disclose the vulnerable endpoint, action, parameter or function, so the precise input path remains unknown.	See mitigation notes	CVE4.3 NVDPending
Feb 02, 2023	CVE-2022-40692 Sunshine Photo Cart: Cross-site request forgery Sunshine Photo Cart is affected by cross-site request forgery. Exposure depends on how the affected operation is made reachable by the site. Exploitation relies on a signed-in privileged user submitting an attacker-controlled request. The public source does not disclose the vulnerable endpoint, action, parameter or function, so the precise input path remains unknown.	See mitigation notes	CVE5.4 NVD8.8
Jan 09, 2023	CVE-2022-4301 Sunshine Photo Cart: Cross-site scripting Sunshine Photo Cart is affected by cross-site scripting. Exposure depends on how the affected operation is made reachable by the site. Injected script can execute in the affected site's origin when the vulnerable output is viewed. The public source does not disclose the vulnerable endpoint, action, parameter or function, so the precise input path remains unknown.	See mitigation notes	CVE6.1 NVD6.1

Data attribution: This product uses the NVD API but is not endorsed or certified by the NVD.

Vulnerability data licensing

CVE. Copyright © 1999–2026, The MITRE Corporation. MITRE hereby grants you a perpetual, worldwide, non-exclusive, no-charge, royalty-free, irrevocable copyright license to reproduce, prepare derivative works of, publicly display, publicly perform, sublicense, and distribute Common Vulnerabilities and Exposures (CVE™). Any copy you make for such purposes is authorized provided that you reproduce MITRE's copyright designation and this license in any such copy.

CWE. Copyright © 2006–2026, The MITRE Corporation. CWE™ is free to use by any organization or individual for any research, development, and/or commercial purposes, per these CWE Terms of Use. Accordingly, The MITRE Corporation hereby grants you a non-exclusive, royalty-free license to use CWE for research, development, and commercial purposes. Any copy you make for such purposes is authorized on the condition that you reproduce MITRE’s copyright designation and this license in any such copy.

CVSS. CVSS is owned and managed by FIRST.Org, Inc. (FIRST) and used by permission.

Source-record text is CVE/CNA content delivered through the NVD API. Fused summaries and remediation guidance are independently authored and are not attributed to NVD.

All other copyrights and trademarks are the property of their respective owners.

Full data sources, terms, and disclaimers