Unknown Sunshine Photo Cart vulnerabilities

4 vulnerabilities

Known vulnerabilities in Unknown Sunshine Photo Cart, newest first, with CVSS severity, EPSS, KEV listings, ransomware use and the affected versions.

5.3CVE-2026-108069unknownsunshine photo cart
EPSS score
0.16%
The Sunshine Photo Cart WordPress plugin before 3.7.4 does not check whether a visitor is permitted to access a restricted gallery before accepting comment submissions for its images, while it does perform that check when displaying comments, allowing unauthenticated attackers to inject attacker-chosen content with a chosen author name and email into galleries the owner has restricted (password-protected, email-gated, private, account-only or expired).6.1CVE-2022-4301sunshinephotocartsunshine_photo_cart+2
EPSS score
0.91%
The Sunshine Photo Cart WordPress plugin before 2.9.15 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting.7.5CVE-2026-16561unknownsunshine photo cart+1
EPSS score
0.41%
The Sunshine Photo Cart WordPress plugin before 3.6.12 does not perform access control checks in one of its AJAX actions, allowing unauthenticated users to retrieve the comments of images belonging to private, password-protected or otherwise access-restricted galleries.5.3CVE-2026-85037unknownsunshine photo cart+1
EPSS score
0.30%
The Sunshine Photo Cart WordPress plugin before 3.7 does not validate that a client-supplied price identifier belongs to the item being purchased when it is added to the cart, allowing unauthenticated users to buy items at a lower price defined elsewhere on the site and complete an order at that price, resulting in financial loss for the site owner.