Threat database

18 threats

Threat database
Severity	CVSS	Signals	Threat	Source	Published
Critical	9.8	EPSS 0.5%	CVE-2026-104730Sunshine Photo Cart – Client Photo Gallery & Photo Proofing for Photographers · Deserialization of Untrusted Data Critical9.8EPSS 0.5%2026-10-16CVE Database V5CVE-2026-104730 The Sunshine Photo Cart – Client Photo Gallery & Photo Proofing for Photographers plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 3.7.4 via deserialization of untrusted input . This makes it possible for unauthenticated attackers to inject a PHP Object. No known POP chain is present in the vulnerable software, which means this vulnerability has no impact unless another plugin or theme containing a POP chain is installed on the site. If a POP chain is present via an additional plugin or theme installed on the target system, it may allow the attacker to perform actions like delete arbitrary files, retrieve sensitive data, or execute code depending on the POP chain present. If a POP chain is present via an additional plugin or theme installed on the target system, the attacker can store the malicious payload unauthenticated via the public favorites page and trigger deserialization by viewing any image in a non-viewable or private gallery. EPSS 0.5%Vulnerability sunshinephotocart #cwe-502	CVE Database V5	2026-10-16
Medium	6.3	EPSS 0.3%	CVE-2026-57703Sunshine Photo Cart · Missing Authorization Medium6.3EPSS 0.3%2026-07-23CVE Database V5CVE-2026-57703 Subscriber Broken Access Control in Sunshine Photo Cart <= 3.6.10.1 versions. EPSS 0.3%Vulnerability sunshinephotocart #cwe-862	CVE Database V5	2026-07-23
Medium	5.3	EPSS 0.3%	CVE-2026-39564Sunshine Photo Cart · Insertion of Sensitive Information Into Sent Data Medium5.3EPSS 0.3%2026-04-08CVE Database V5CVE-2026-39564 Insertion of Sensitive Information Into Sent Data vulnerability in sunshinephotocart Sunshine Photo Cart sunshine-photo-cart allows Retrieve Embedded Sensitive Data.This issue affects Sunshine Photo Cart: from n/a through < 3.6.2. EPSS 0.3%Vulnerability sunshinephotocart	CVE Database V5	2026-04-08
Medium	6.5	EPSS 0.3%	CVE-2025-67973Sunshine Photo Cart · Missing Authorization Medium6.5EPSS 0.3%2026-02-20CVE Database V5CVE-2025-67973 Missing Authorization vulnerability in sunshinephotocart Sunshine Photo Cart sunshine-photo-cart allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Sunshine Photo Cart: from n/a through <= 3.5.6.2. EPSS 0.3%Vulnerability sunshinephotocart	CVE Database V5	2026-02-20
Medium	5.3	EPSS 0.2%	CVE-2026-24994Sunshine Photo Cart · Missing Authorization Medium5.3EPSS 0.2%2026-02-03CVE Database V5CVE-2026-24994 Missing Authorization vulnerability in sunshinephotocart Sunshine Photo Cart sunshine-photo-cart allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Sunshine Photo Cart: from n/a through <= 3.5.7.2. EPSS 0.2%Vulnerability sunshinephotocart	CVE Database V5	2026-02-03
Medium	4.3	EPSS 0.2%	CVE-2025-68535Sunshine Photo Cart · Missing Authorization Medium4.3EPSS 0.2%2025-12-24CVE Database V5CVE-2025-68535 Missing Authorization vulnerability in sunshinephotocart Sunshine Photo Cart sunshine-photo-cart allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Sunshine Photo Cart: from n/a through <= 3.5.7.1. EPSS 0.2%Vulnerability sunshinephotocart	CVE Database V5	2025-12-24
Medium	5.3	EPSS 0.3%	CVE-2025-62892Sunshine Photo Cart · Missing Authorization Medium5.3EPSS 0.3%2025-10-27CVE Database V5CVE-2025-62892 Missing Authorization vulnerability in sunshinephotocart Sunshine Photo Cart sunshine-photo-cart allows Accessing Functionality Not Properly Constrained by ACLs.This issue affects Sunshine Photo Cart: from n/a through <= 3.5.3. EPSS 0.3%Vulnerability sunshinephotocart	CVE Database V5	2025-10-27
High	8.8	EPSS 0.6%	CVE-2025-5482Sunshine Photo Cart – Client Photo Gallery & Photo Proofing for Photographers · Unverified Password Change High8.8EPSS 0.6%2025-06-04CVE Database V5CVE-2025-5482 The Sunshine Photo Cart: Free Client Photo Galleries for Photographers plugin for WordPress is vulnerable to privilege escalation via account takeover in all versions up to, and including, 3.4.11. This is due to the plugin not properly validating a user-supplied key. This makes it possible for authenticated attackers, with Subscriber-level access and above, to change arbitrary user's passwords through the password reset functionality, including administrators, and leverage that to reset the user's password and gain access to their account. EPSS 0.6%Vulnerability sunshinephotocart #cwe-620	CVE Database V5	2025-06-04
Critical	9.8	EPSS 0.7%	CVE-2025-31084Sunshine Photo Cart · Deserialization of Untrusted Data Critical9.8EPSS 0.7%2025-04-01CVE Database V5CVE-2025-31084 Deserialization of Untrusted Data vulnerability in sunshinephotocart Sunshine Photo Cart sunshine-photo-cart allows Object Injection.This issue affects Sunshine Photo Cart: from n/a through <= 3.4.10. EPSS 0.7%Vulnerability sunshinephotocart	CVE Database V5	2025-04-01
Medium	4.3	EPSS 0.4%	CVE-2024-49697Sunshine Photo Cart · Missing Authorization Medium4.3EPSS 0.4%2024-11-19CVE Database V5CVE-2024-49697 Missing Authorization vulnerability in sunshinephotocart Sunshine Photo Cart sunshine-photo-cart allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Sunshine Photo Cart: from n/a through <= 3.2.9. EPSS 0.4%Vulnerability sunshinephotocart	CVE Database V5	2024-11-19
High	7.1	EPSS 0.4%	CVE-2024-47314Sunshine Photo Cart · Missing Authorization High7.1EPSS 0.4%2024-11-01CVE Database V5CVE-2024-47314 Missing Authorization vulnerability in sunshinephotocart Sunshine Photo Cart sunshine-photo-cart allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Sunshine Photo Cart: from n/a through <= 3.2.8. EPSS 0.4%Vulnerability sunshinephotocart	CVE Database V5	2024-11-01
Medium	5.3	EPSS 0.4%	CVE-2024-44038Sunshine Photo Cart · Missing Authorization Medium5.3EPSS 0.4%2024-11-01CVE Database V5CVE-2024-44038 Missing Authorization vulnerability in sunshinephotocart Sunshine Photo Cart sunshine-photo-cart allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Sunshine Photo Cart: from n/a through <= 3.2.9. EPSS 0.4%Vulnerability sunshinephotocart	CVE Database V5	2024-11-01
Medium	4.3	EPSS 0.4%	CVE-2024-43136Sunshine Photo Cart · Missing Authorization Medium4.3EPSS 0.4%2024-11-01CVE Database V5CVE-2024-43136 Missing Authorization vulnerability in sunshinephotocart Sunshine Photo Cart sunshine-photo-cart.This issue affects Sunshine Photo Cart: from n/a through <= 3.2.1. EPSS 0.4%Vulnerability sunshinephotocart	CVE Database V5	2024-11-01
Medium	4.7	EPSS 0.3%	CVE-2024-50463Sunshine Photo Cart · Open Redirect Medium4.7EPSS 0.3%2024-10-28CVE Database V5CVE-2024-50463 URL Redirection to Untrusted Site ('Open Redirect') vulnerability in sunshinephotocart Sunshine Photo Cart sunshine-photo-cart.This issue affects Sunshine Photo Cart: from n/a through <= 3.2.9. EPSS 0.3%Vulnerability sunshinephotocart	CVE Database V5	2024-10-28
High	7.1	EPSS 0.6%	CVE-2024-43971Sunshine Photo Cart · Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in… High7.1EPSS 0.6%2024-09-17CVE Database V5CVE-2024-43971 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in sunshinephotocart Sunshine Photo Cart sunshine-photo-cart.This issue affects Sunshine Photo Cart: from n/a through <= 3.2.5. EPSS 0.6%Vulnerability sunshinephotocart	CVE Database V5	2024-09-17
Medium	5.4	EPSS 0.5%	CVE-2024-30221Sunshine Photo Cart · Deserialization of Untrusted Data Medium5.4EPSS 0.5%2024-03-28CVE Database V5CVE-2024-30221 Deserialization of Untrusted Data vulnerability in sunshinephotocart Sunshine Photo Cart sunshine-photo-cart.This issue affects Sunshine Photo Cart: from n/a through <= 3.1.1. EPSS 0.5%Vulnerability sunshinephotocart	CVE Database V5	2024-03-28
High	7.1	EPSS 0.7%	CVE-2024-30194Sunshine Photo Cart · Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in… High7.1EPSS 0.7%2024-03-27CVE Database V5CVE-2024-30194 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in sunshinephotocart Sunshine Photo Cart sunshine-photo-cart.This issue affects Sunshine Photo Cart: from n/a through <= 3.1.1. EPSS 0.7%Vulnerability sunshinephotocart	CVE Database V5	2024-03-27
Medium	5.3	EPSS 0.7%	CVE-2024-1294Sunshine Photo Cart – Client Photo Gallery & Photo Proofing for Photographers · Improper Access Control Medium5.3EPSS 0.7%2024-02-20CVE Database V5CVE-2024-1294 The Sunshine Photo Cart: Free Client Galleries for Photographers plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 3.0.24 via the 'invoice'. This makes it possible for unauthenticated attackers to extract sensitive data including customer email and physical addresses. EPSS 0.7%Vulnerability sunshinephotocart #cwe-284	CVE Database V5	2024-02-20

Showing 1–18 of 18 results