Unknown Sunshine Photo Cart vulnerabilities

3 CVEs affecting Unknown Sunshine Photo Cart, 0 known to be exploited (CISA KEV), with EPSS scores. Latest: CVE-2026-108069, published 2026-10-14.

Highest priority

Known exploited (CISA KEV) first, then by EPSS exploit probability.

CVE-2026-16561, published 2026-08-05. High severity, CVSS 7.5. EPSS: 0.4% chance of exploitation in the next 30 days. The Sunshine Photo Cart WordPress plugin before 3.6.12 does not perform access control checks in one of its AJAX actions, allowing unauthenticated users to retrieve the comments of images belonging…
CVE-2026-85037, published 2026-09-09. Medium severity, CVSS 5.3. EPSS: 0.3% chance of exploitation in the next 30 days. The Sunshine Photo Cart WordPress plugin before 3.7 does not validate that a client-supplied price identifier belongs to the item being purchased when it is added to the cart, allowing…
CVE-2026-108069, published 2026-10-14. Medium severity, CVSS 5.3. EPSS: 0.2% chance of exploitation in the next 30 days. The Sunshine Photo Cart WordPress plugin before 3.7.4 does not check whether a visitor is permitted to access a restricted gallery before accepting comment submissions for its images, while it does…