466 matches found
CVE-2026-93617: Deserialization of Untrusted Data
Deserialization of Untrusted Data vulnerability in WP Sunshine Sunshine Photo Cart sunshine-photo-cart allows Object Injection.This issue affects Sunshine Photo Cart: from n/a through 3.7.1...
WordPress Sunshine Photo Cart plugin <= 3.7.1 - PHP Object Injection vulnerability
PHP Object Injection vulnerability discovered by Ananda Dhakal Patchstack in WordPress Plugin Sunshine Photo Cart versions = 3.7.1...
CVE-2026-85037
The Sunshine Photo Cart WordPress plugin before 3.7 does not validate that a client-supplied price identifier belongs to the item being purchased when it is added to the cart, allowing unauthenticated users to buy items at a lower price defined elsewhere on the site and complete an order at that...
CVE-2026-85037 Sunshine Photo Cart < 3.7 - Unauthenticated Price Manipulation via IDOR
The Sunshine Photo Cart WordPress plugin before 3.7 does not validate that a client-supplied price identifier belongs to the item being purchased when it is added to the cart, allowing unauthenticated users to buy items at a lower price defined elsewhere on the site and complete an order at that...
CVE-2026-85037
The Sunshine Photo Cart WordPress plugin (versions before 3.7 ) is vulnerable to an unauthenticated price manipulation via an Insecure Direct Object Reference (IDOR). The application fails to validate that a client-supplied price identifier corresponds to the specific item being added to the cart...
CVE-2026-85037 Sunshine Photo Cart < 3.7 - Unauthenticated Price Manipulation via IDOR
The Sunshine Photo Cart WordPress plugin before 3.7 does not validate that a client-supplied price identifier belongs to the item being purchased when it is added to the cart, allowing unauthenticated users to buy items at a lower price defined elsewhere on the site and complete an order at that...
WordPress Sunshine Photo Cart plugin < 3.7 - Unauthenticated Price Manipulation vulnerability
Unauthenticated Price Manipulation vulnerability discovered by Farid Narimanov in WordPress Plugin Sunshine Photo Cart versions 3.7...
EUVD-2026-74717
The Sunshine Photo Cart WordPress plugin before 3.7 does not validate that a client-supplied price identifier belongs to the item being purchased when it is added to the cart, allowing unauthenticated users to buy items at a lower price defined elsewhere on the site and complete an order at that...
CVE-2026-85037: Authorization Bypass Through User-Controlled Key
The Sunshine Photo Cart WordPress plugin before 3.7 does not validate that a client-supplied price identifier belongs to the item being purchased when it is added to the cart, allowing unauthenticated users to buy items at a lower price defined elsewhere on the site and complete an order at that...
PT-2026-88874
The Sunshine Photo Cart WordPress plugin before 3.7 does not validate that a client-supplied price identifier belongs to the item being purchased when it is added to the cart, allowing unauthenticated users to buy items at a lower price defined elsewhere on the site and complete an order at that...
WordPress Sunshine Photo Cart plugin < 3.6.12 - Unauthenticated Private Gallery Comment Disclosure vulnerability
Unauthenticated Private Gallery Comment Disclosure vulnerability discovered by Farid Narimanov in WordPress Plugin Sunshine Photo Cart versions 3.6.12...
CVE-2026-16561
The Sunshine Photo Cart WordPress plugin before 3.6.12 does not perform access control checks in one of its AJAX actions, allowing unauthenticated users to retrieve the comments of images belonging to private, password-protected or otherwise access-restricted galleries...
CVE-2026-16561 Sunshine Photo Cart < 3.6.12 - Unauthenticated Private Gallery Comment Disclosure
The Sunshine Photo Cart WordPress plugin before 3.6.12 does not perform access control checks in one of its AJAX actions, allowing unauthenticated users to retrieve the comments of images belonging to private, password-protected or otherwise access-restricted galleries...
EUVD-2026-53100
The Sunshine Photo Cart WordPress plugin before 3.6.12 does not perform access control checks in one of its AJAX actions, allowing unauthenticated users to retrieve the comments of images belonging to private, password-protected or otherwise access-restricted galleries...
CVE-2026-16561
The Sunshine Photo Cart WordPress plugin (versions before 3.6.12 ) is vulnerable to an unauthenticated private gallery comment disclosure . The root cause is a failure to perform access control checks within one of the plugin's AJAX actions . This allows unauthenticated users to retrieve comments...
CVE-2026-16561 Sunshine Photo Cart < 3.6.12 - Unauthenticated Private Gallery Comment Disclosure
The Sunshine Photo Cart WordPress plugin before 3.6.12 does not perform access control checks in one of its AJAX actions, allowing unauthenticated users to retrieve the comments of images belonging to private, password-protected or otherwise access-restricted galleries...
PT-2026-67976
Name of the Vulnerable Software and Affected Versions Sunshine Photo Cart versions prior to 3.6.12 Description An issue exists where the plugin fails to perform access control checks in an AJAX action. This allows unauthenticated users to retrieve comments from images located within private,...
CVE-2026-16561: Missing Authorization
The Sunshine Photo Cart WordPress plugin before 3.6.12 does not perform access control checks in one of its AJAX actions, allowing unauthenticated users to retrieve the comments of images belonging to private, password-protected or otherwise access-restricted galleries...
WordPress Sunshine Photo Cart <2.9.15 - Cross-Site Scripting Detection
WordPress Sunshine Photo Cart plugin before 2.9.15 contains a cross-site scripting vulnerability. The plugin does not sanitize and escape a parameter before outputting it back in the page. An attacker can inject arbitrary script in the browser of an unsuspecting user in the context of the affecte...