Threat Database

Threat Entry Updated 2026-06-17

Sunshine Photo Cart - Cross-Site Scripting (XSS) (CVE-2024-30194)

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in sunshinephotocart Sunshine Photo Cart sunshine-photo-cart.This issue affects Sunshine Photo Cart: from n/a through

PLUGIN Sunshine Photo Cart

CVE-2024-30194

HIGH CVSS 7.1 2024-03-27

Risk Score

Open Full Technical Breakdown

Threat Entry Updated 2026-06-17

Sunshine Photo Cart - Information Disclosure (CVE-2024-1294)

The Sunshine Photo Cart: Free Client Galleries for Photographers plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 3.0.24 via the 'invoice'. This makes it possible for unauthenticated attackers to extract sensitive data including customer email and physical addresses.

PLUGIN Sunshine Photo Cart

CVE-2024-1294

MEDIUM CVSS 5.3 2024-02-29

Risk Score

Open Full Technical Breakdown

Threat Entry Updated 2026-06-17

Sunshine Photo Cart - Broken Access Control (CVE-2023-41796)

Authorization Bypass Through User-Controlled Key vulnerability in WP Sunshine Sunshine Photo Cart: Free Client Galleries for Photographers.This issue affects Sunshine Photo Cart: Free Client Galleries for Photographers: from n/a before 3.0.0.

PLUGIN Sunshine Photo Cart

CVE-2023-41796

MEDIUM CVSS 5.3 2023-12-20

Risk Score

Open Full Technical Breakdown

Threat Entry Updated 2026-06-17

Sunshine Photo Cart - Cross-Site Request Forgery (CSRF) (CVE-2021-4415)

The Sunshine Photo Cart plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 2.8.28 This is due to missing or incorrect nonce validation on the sunshine_products_quicksave_post() function. This makes it possible for unauthenticated attackers to save custom post data via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.

PLUGIN Sunshine Photo Cart

CVE-2021-4415

MEDIUM CVSS 4.3 2023-07-12

Risk Score

Open Full Technical Breakdown

Threat Entry Updated 2026-06-17

Sunshine Photo Cart - Cross-Site Request Forgery (CSRF) (CVE-2022-40692)

Cross-Site Request Forgery (CSRF) vulnerability in WP Sunshine Sunshine Photo Cart plugin

PLUGIN Sunshine Photo Cart

CVE-2022-40692

MEDIUM CVSS 5.4 2023-02-02

Risk Score

Open Full Technical Breakdown

Threat Entry Updated 2026-06-17

Sunshine Photo Cart - Cross-Site Scripting (XSS) (CVE-2022-4301)

The Sunshine Photo Cart WordPress plugin before 2.9.15 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting.

PLUGIN Sunshine Photo Cart

CVE-2022-4301

MEDIUM CVSS 6.1 2023-01-09

Risk Score

Open Full Technical Breakdown