5.3
Moyenne
CVE-2026-108069 The Sunshine Photo Cart WordPress plugin before 3.7.4 does not check whether a visitor is permitted to access a…
Description
The Sunshine Photo Cart WordPress plugin before 3.7.4 does not check whether a visitor is permitted to access a restricted gallery before accepting comment submissions for its images, while it does perform that check when displaying comments, allowing unauthenticated attackers to inject attacker-chosen content with a chosen author name and email into galleries the owner has restricted (password-protected, email-gated, private, account-only or expired).
Produits et versions touchés
| Produit | Versions touchées | Corrigé en |
|---|---|---|
| Sunshine Photo Cart 3.7 | premières → < 3.7.4 | 3.7.4 |
Autres CVE de Sunshine Photo Cart
Les 4 CVE de Sunshine Photo Cart →
CVE-2026-85037
The Sunshine Photo Cart WordPress plugin before 3.7 does not validate that a client-supplied price identifier belongs…
5.3
Moyenne
CVE-2026-16561
The Sunshine Photo Cart WordPress plugin before 3.6.12 does not perform access control checks in one of its AJAX…
7.5
Élevée
CVE-2022-4301
The Sunshine Photo Cart WordPress plugin before 2.9.15 does not sanitise and escape a parameter before outputting it…
6.1
Moyenne