CVE-2024-1294mediumCWE-284

CVE-2024-1294: medium-severity vulnerability in sunshinephotocart Sunshine Photo Cart – Client…

Sunshine Photo Cart: Free Client Galleries for Photographers <= 3.0.24 - Unauthenticated Sensitive Information Exposure via Invoice

Published · Updated

Follow this CVE+ Monitor Sunshine Photo Cart – Client Photo Gallery & Photo Proofing for Photographers

E-mail alert when it lands in KEV, gets a public PoC or its score goes up.

13Vexday Risk Score

No sign of exploitation. No public exploitation artifact known so far.

ssvc Trackcvss 5.3epss 0.7%
The Sunshine Photo Cart: Free Client Galleries for Photographers plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 3.0.24 via the 'invoice'. This makes it possible for unauthenticated attackers to extract sensitive data including customer email and physical addresses.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
Affected products
sunshinephotocart · Sunshine Photo Cart – Client Photo Gallery & Photo Proofing for Photographers
Related CVEs — sunshinephotocart Sunshine Photo Cart – Client…

In the same product, most dangerous first.

CVE-2025-5482HIGHSunshine Photo Cart <= 3.4.11 - Authenticated (Subscriber+) Privilege EscalationEPSS 0.6%CVE-2026-104730CRITICALSunshine Photo Cart <= 3.7.4 - Unauthenticated PHP Object Injection via 'key' ParameterEPSS 0.5%CVE-2021-4415MEDIUMSunshine Photo Cart <= 2.8.28 - Cross-Site Request Forgery BypassEPSS 0.4%