257 matches found
Sunshine Photo Cart <= 3.1.1 - Reflected Cross-Site Scripting
WP Sunshine Sunshine Photo Cart versions up to 3.1.1 contain a cross-site scripting caused by improper neutralization of input during web page generation, letting attackers execute malicious scripts in users' browsers, exploit requires attacker to craft malicious input. id: CVE-2024-30194 info:...
Sunshine Photo Cart <= 3.2.5 - Reflected Cross-Site Scripting
WP Sunshine Sunshine Photo Cart versions up to 3.2.5 contain a reflected cross-site scripting caused by improper input neutralization during web page generation, letting attackers execute malicious scripts in users' browsers, exploit requires attacker to craft malicious input. id: CVE-2024-43971...
CVE-2026-85037
The Sunshine Photo Cart WordPress plugin before 3.7 does not validate that a client-supplied price identifier belongs to the item being purchased when it is added to the cart, allowing unauthenticated users to buy items at a lower price defined elsewhere on the site and complete an order at that...
EUVD-2026-74717
The Sunshine Photo Cart WordPress plugin before 3.7 does not validate that a client-supplied price identifier belongs to the item being purchased when it is added to the cart, allowing unauthenticated users to buy items at a lower price defined elsewhere on the site and complete an order at that...
WordPress Sunshine Photo Cart plugin < 3.7 - Unauthenticated Price Manipulation vulnerability
Unauthenticated Price Manipulation vulnerability discovered by Farid Narimanov in WordPress Plugin Sunshine Photo Cart versions 3.7...
CVE-2026-85037 Sunshine Photo Cart < 3.7 - Unauthenticated Price Manipulation via IDOR
The Sunshine Photo Cart WordPress plugin before 3.7 does not validate that a client-supplied price identifier belongs to the item being purchased when it is added to the cart, allowing unauthenticated users to buy items at a lower price defined elsewhere on the site and complete an order at that...
CVE-2026-85037
The Sunshine Photo Cart WordPress plugin, prior to version 3.7 , fails to validate that a client-supplied price identifier belongs to the item being purchased when added to the cart. This Insecure Direct Object Reference (IDOR) flaw allows unauthenticated users to associate a lower price defined ...
WordPress Sunshine Photo Cart plugin < 3.6.12 - Unauthenticated Private Gallery Comment Disclosure vulnerability
Unauthenticated Private Gallery Comment Disclosure vulnerability discovered by Farid Narimanov in WordPress Plugin Sunshine Photo Cart versions 3.6.12...
CVE-2026-16561
The Sunshine Photo Cart WordPress plugin before 3.6.12 does not perform access control checks in one of its AJAX actions, allowing unauthenticated users to retrieve the comments of images belonging to private, password-protected or otherwise access-restricted galleries...
CVE-2026-16561 Sunshine Photo Cart < 3.6.12 - Unauthenticated Private Gallery Comment Disclosure
The Sunshine Photo Cart WordPress plugin before 3.6.12 does not perform access control checks in one of its AJAX actions, allowing unauthenticated users to retrieve the comments of images belonging to private, password-protected or otherwise access-restricted galleries...
EUVD-2026-53100
The Sunshine Photo Cart WordPress plugin before 3.6.12 does not perform access control checks in one of its AJAX actions, allowing unauthenticated users to retrieve the comments of images belonging to private, password-protected or otherwise access-restricted galleries...
CVE-2026-16561
The CVE concerns the Sunshine Photo Cart WordPress plugin, version before 3.6.12, where an AJAX action lacks access control. This allows unauthenticated users to retrieve comments for images in private or otherwise restricted galleries. The issue stems from missing authorization checks in the aff...
CVE-2026-57703
CVE-2026-57703 affects WordPress Sunshine Photo Cart plugin versions
EUVD-2026-48174
Subscriber Broken Access Control in Sunshine Photo Cart = 3.6.10.1 versions...
WordPress Sunshine Photo Cart plugin <= 3.6.10.1 - Broken Access Control vulnerability
Broken Access Control vulnerability discovered by dutafi in WordPress Plugin Sunshine Photo Cart versions = 3.6.10.1...
CVE-2026-42776
Missing Authorization vulnerability in WP Sunshine Sunshine Photo Cart allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects Sunshine Photo Cart: from n/a through 3.6.7...
WordPress Sunshine Photo Cart plugin <= 3.6.7 - Broken Access Control vulnerability
Broken Access Control vulnerability discovered by Dave Jong Patchstack in WordPress Plugin Sunshine Photo Cart versions = 3.6.7...
CVE-2026-42776
Missing Authorization vulnerability in WP Sunshine Sunshine Photo Cart allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects Sunshine Photo Cart: from n/a through 3.6.7...
CVE-2026-42776 WordPress Sunshine Photo Cart plugin <= 3.6.7 - Broken Access Control vulnerability
Missing Authorization vulnerability in WP Sunshine Sunshine Photo Cart allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects Sunshine Photo Cart: from n/a through 3.6.7...