WordPress plugin

Sunshine Photo Cart – Client Photo Gallery & Photo Proofing for Photographers security & vulnerabilities

Q: Does Sunshine Photo Cart – Client Photo Gallery & Photo Proofing for Photographers have known vulnerabilities?

Yes. VulnCrest Radar lists 30 known vulnerabilities in Sunshine Photo Cart – Client Photo Gallery & Photo Proofing for Photographers: 3 critical, 3 high, 24 medium. None are known to affect version null.

Q: How do I check which version of Sunshine Photo Cart – Client Photo Gallery & Photo Proofing for Photographers I run?

In wp-admin open Plugins → Installed Plugins; the version is shown under the name. Without admin access, our passive Check my site tool can often read it from public files.

Q: What is the most recent Sunshine Photo Cart – Client Photo Gallery & Photo Proofing for Photographers vulnerability?

CVE-2026-111842, published Oct 22, 2026: Sunshine Photo Cart – Client Photo Gallery & Photo Proofing for Photographers <= 3.7.5 - Missing Authorization. Severity: Medium (CVSS 5.3).

Q: Is any Sunshine Photo Cart – Client Photo Gallery & Photo Proofing for Photographers vulnerability listed in CISA KEV?

No. None of the known Sunshine Photo Cart – Client Photo Gallery & Photo Proofing for Photographers vulnerabilities is currently listed in the CISA KEV catalog.

sunshine-photo-cart— active installsLast vulnerability Oct 22, 2026

No known unpatched vulnerabilities in the latest version

All 30 known vulnerabilities are fixed in the latest release. If you run an older version, update to null or newer.

Watch plugin

30Known vulnerabilities

Critical3
High3
Medium24
Low0

Vulnerabilities per year

All Sunshine Photo Cart – Client Photo Gallery & Photo Proofing for Photographers vulnerabilities

Sunshine Photo Cart – Client Photo Gallery & Photo Proofing for Photographers vulnerabilities
Severity	Vulnerability	CVE	Published
Medium5.3	Missing Authorization ≤3.7.5Update to 3.8	CVE-2026-111842	Oct 22
Critical9.8	Unauthenticated PHP Object Injection via 'key' Parameter ≤3.7.4Update to 3.7.5	CVE-2026-104730	Oct 15
Medium5.3	Missing Authorization ≤3.7.4Update to 3.7.5	CVE-2026-109689	Oct 15
Medium5.3	Missing Authorization <3.7.4Update to 3.7.4	CVE-2026-108069	Oct 14
High7.5	Authenticated (Custom Role+) PHP Object Injection ≤3.7.1Update to 3.7.2	CVE-2026-93617	Oct 03
Medium5.3	Unauthenticated Insecure Direct Object Reference ≤3.6Update to 3.7	CVE-2026-85037	Sep 07
Medium5.3	Missing Authorization ≤3.6.11Update to 3.6.12	CVE-2026-16561	Jul 27
Medium4.3	Missing Authorization ≤3.6.10.1Update to 3.6.11	CVE-2026-57703	Jul 20
Medium4.3	Missing Authorization ≤3.6.7Update to 3.6.8	CVE-2026-42776	May 26
Medium5.3	Unauthenticated Information Exposure <3.6.2Update to 3.6.2	CVE-2026-39564	Mar 26
Medium5.3	Missing Authorization ≤3.5.6.2Update to 3.5.7.1	CVE-2025-67973	Jan 27
Medium5.3	Missing Authorization ≤3.5.7.2Update to 3.5.7.3	CVE-2026-24994	Jan 23
Medium4.3	Missing Authorization ≤3.5.7.1Update to 3.5.7.2	CVE-2025-68535	Dec 30, 2025
Medium5.3	Missing Authorization ≤3.5.3Update to 3.5.4	CVE-2025-62892	Aug 29, 2025
High8.8	Authenticated (Subscriber+) Privilege Escalation ≤3.4.11Update to 3.4.12	CVE-2025-5482	Jun 3, 2025
Critical9.8	Unauthenticated PHP Object Injection ≤3.4.10Update to 3.4.11	CVE-2025-31084	Mar 28, 2025
Medium6.1	Open Redirect ≤3.2.9Update to 3.2.11	CVE-2024-50463	Oct 24, 2024
Medium4.3	Missing Authorization ≤3.2.9Update to 3.2.10	CVE-2024-49697	Oct 21, 2024
Medium4.3	Missing Authorization ≤3.2.8Update to 3.2.9	CVE-2024-47314	Sep 25, 2024
Medium5.3	Missing Authorization ≤3.2.9Update to 3.2.10	CVE-2024-44038	Sep 23, 2024
Medium6.1	Reflected Cross-Site Scripting ≤3.2.5Update to 3.2.6	CVE-2024-43971	Aug 28, 2024
Medium4.3	Missing Authorization ≤3.2.1Update to 3.2.2	CVE-2024-43136	Aug 7, 2024
Critical9.8	Unauthenticated PHP Object Injection ≤3.1.1Update to 3.1.2	CVE-2024-30221	Mar 26, 2024
Medium6.1	Reflected Cross-Site Scripting ≤3.1.1Update to 3.1.2	CVE-2024-30194	Mar 25, 2024
Medium5.3	Unauthenticated Sensitive Information Exposure via Invoice ≤3.0.24Update to 3.1	CVE-2024-1294	Feb 12, 2024
Medium5.3	Insecure Direct Object Reference to Order Manipulation ≤2.9.25Update to 3.0	CVE-2023-41796	Sep 5, 2023
Medium6.1	Reflected Cross-Site Scripting ≤2.9.14Update to 2.9.15	CVE-2022-4301	Dec 12, 2022
High8.8	Cross-Site Request Forgery ≤2.9.13Update to 2.9.14	CVE-2022-40692	Dec 2, 2022
Medium6.3	Missing Authorization ≤2.9.13Update to 2.9.14	CVE-2022-45826	Dec 2, 2022
Medium4.3	Cross-Site Request Forgery Bypass ≤2.8.28Update to 2.8.29	CVE-2021-4415	Jun 21, 2021

Sunshine Photo Cart – Client Photo Gallery & Photo Proofing for Photographers: common questions

Does Sunshine Photo Cart – Client Photo Gallery & Photo Proofing for Photographers have known vulnerabilities?

Yes. VulnCrest Radar lists 30 known vulnerabilities in Sunshine Photo Cart – Client Photo Gallery & Photo Proofing for Photographers: 3 critical, 3 high, 24 medium. None are known to affect version null.

How do I check which version of Sunshine Photo Cart – Client Photo Gallery & Photo Proofing for Photographers I run?

In wp-admin open Plugins → Installed Plugins; the version is shown under the name. Without admin access, our passive Check my site tool can often read it from public files.

What is the most recent Sunshine Photo Cart – Client Photo Gallery & Photo Proofing for Photographers vulnerability?

CVE-2026-111842, published Oct 22, 2026: Sunshine Photo Cart – Client Photo Gallery & Photo Proofing for Photographers <= 3.7.5 - Missing Authorization. Severity: Medium (CVSS 5.3).

Is any Sunshine Photo Cart – Client Photo Gallery & Photo Proofing for Photographers vulnerability listed in CISA KEV?

No. None of the known Sunshine Photo Cart – Client Photo Gallery & Photo Proofing for Photographers vulnerabilities is currently listed in the CISA KEV catalog.