Plugin icon

Sunshine Photo Cart – Client Photo Gallery & Photo Proofing for Photographers

sunshine-photo-cart

Vulnerabilities:

24

Last Updated:

September 10, 2026

Active Installs:

1000

Published
Title
Fixed in
CVSS
Published
2026-09-07
Title
Sunshine Photo Cart < 3.7 - Unauthenticated Price Manipulation via IDOR
Fixed in
Fixed in 3.7
CVSS
5.3 (medium)
Published
2026-07-27
Title
Sunshine Photo Cart < 3.6.12 - Unauthenticated Private Gallery Comment Disclosure
Fixed in
Fixed in 3.6.12
CVSS
5.3 (medium)
Published
2026-07-20
Title
Sunshine Photo Cart – Client Photo Gallery & Photo Proofing for Photographers < 3.6.11 - Missing Authorization
Fixed in
Fixed in 3.6.11
CVSS
4.3 (medium)
Published
2026-05-26
Title
Sunshine Photo Cart – Client Photo Gallery & Photo Proofing for Photographers < 3.6.8 - Missing Authorization
Fixed in
Fixed in 3.6.8
CVSS
4.3 (medium)
Published
2026-03-26
Title
Sunshine Photo Cart < 3.6.2 - Unauthenticated Information Exposure
Fixed in
Fixed in 3.6.2
CVSS
5.3 (medium)
Published
2026-01-27
Title
Sunshine Photo Cart < 3.5.7.1 - Missing Authorization
Fixed in
Fixed in 3.5.7.1
CVSS
5.3 (medium)
Published
2026-01-23
Title
Sunshine Photo Cart < 3.5.7.3 - Missing Authorization
Fixed in
Fixed in 3.5.7.3
CVSS
5.3 (medium)
Published
2025-12-30
Title
Sunshine Photo Cart < 3.5.7.2 - Missing Authorization
Fixed in
Fixed in 3.5.7.2
CVSS
4.3 (medium)
Published
2025-08-29
Title
Sunshine Photo Cart < 3.5.4 - Missing Authorization
Fixed in
Fixed in 3.5.4
CVSS
5.3 (medium)
Published
2025-06-03
Title
Sunshine Photo Cart < 3.4.12 - Subscriber Privilege Escalation
Fixed in
Fixed in 3.4.12
CVSS
8.8 (high)
Published
2025-03-28
Title
Sunshine Photo Cart < 3.4.11 - Unauthenticated PHP Object Injection
Fixed in
Fixed in 3.4.11
CVSS
9.8 (critical)
Published
2024-10-24
Title
Sunshine Photo Cart < 3.2.11 - Open Redirect
Fixed in
Fixed in 3.2.11
CVSS
6.1 (medium)
Published
2024-10-21
Title
Sunshine Photo Cart < 3.2.10 - Missing Authorization
Fixed in
Fixed in 3.2.10
CVSS
4.3 (medium)
Published
2024-09-25
Title
Sunshine Photo Cart < 3.2.9 - Missing Authorization
Fixed in
Fixed in 3.2.9
CVSS
4.3 (medium)
Published
2024-09-23
Title
Sunshine Photo Cart < 3.2.10 - Missing Authorization
Fixed in
Fixed in 3.2.10
CVSS
5.3 (medium)
Published
2024-08-28
Title
Sunshine Photo Cart < 3.2.6 - Reflected Cross-Site Scripting
Fixed in
Fixed in 3.2.6
CVSS
6.1 (medium)
Published
2024-08-07
Title
Sunshine Photo Cart < 3.2.2 - Missing Authorization
Fixed in
Fixed in 3.2.2
CVSS
4.3 (medium)
Published
2024-03-26
Title
Sunshine Photo Cart: Free Client Photo Galleries for Photographers < 3.1.2 - Unauthenticated PHP Object Injection
Fixed in
Fixed in 3.1.2
CVSS
9.8 (critical)
Published
2024-03-25
Title
Sunshine Photo Cart < 3.1.2 - Reflected Cross-Site Scripting
Fixed in
Fixed in 3.1.2
CVSS
6.1 (medium)
Published
2024-02-12
Title
Sunshine Photo Cart: Free Client Galleries for Photographers < 3.1 - Unauthenticated Sensitive Information Exposure via Invoice
Fixed in
Fixed in 3.1
CVSS
5.3 (medium)
Published
2023-09-05
Title
Sunshine Photo Cart < 3.0 - Insecure Direct Object Reference to Order Manipulation
Fixed in
Fixed in 3.0
CVSS
5.3 (medium)
Published
2022-12-15
Title
Sunshine Photo Cart < 2.9.15 - Reflected XSS
Fixed in
Fixed in 2.9.15
CVSS
7.5 (high)
Published
2022-12-01
Title
Sunshine Photo Cart Plugin < 2.9.14 - Image Location Update via CSRF
Fixed in
Fixed in 2.9.14
CVSS
4.3 (medium)
Published
2021-06-08
Title
CSRF Bypass in Multiple Plugins
Fixed in
Fixed in 2.8.29
CVSS
5.4 (medium)