Skip to main content

Sunshine Photo Cart CVE-2024-30221

MEDIUM
Deserialization of Untrusted Data (CWE-502)
2024-03-28 audit@patchstack.com
WordPress Deserialization Sunshine Photo Cart Wordpress Plugin Sunshinephotocart
5.4
CVSS 3.1 · NVD
Share

Severity by source

NVD PRIMARY
5.4 MEDIUM
AV:N/AC:H/PR:N/UI:N/S:C/C:L/I:L/A:N

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

Attack Vector
Network
Attack Complexity
High
Privileges Required
None
User Interaction
None
Scope
Changed
Confidentiality
Low
Integrity
Low
Availability
None

Lifecycle Timeline

4
Severity Changed
Apr 23, 2026 - 15:22 NVD
CRITICAL MEDIUM
CVSS changed
Apr 23, 2026 - 15:22 NVD
9.8 (CRITICAL) 5.4 (MEDIUM)
CVE Published
Mar 28, 2024 - 06:15 nvd
CRITICAL 9.8
CVE Published
Mar 28, 2024 - 06:15 cve.org
MEDIUM 5.4

DescriptionCVE.org

Deserialization of Untrusted Data vulnerability in sunshinephotocart Sunshine Photo Cart sunshine-photo-cart.This issue affects Sunshine Photo Cart: from n/a through <= 3.1.1.

AnalysisAI

Deserialization of Untrusted Data vulnerability in sunshinephotocart Sunshine Photo Cart sunshine-photo-cart.1.1. Rated medium severity (CVSS 5.4), this vulnerability is remotely exploitable, no authentication required. No vendor patch available.

Technical ContextAI

This vulnerability is classified as Deserialization of Untrusted Data (CWE-502), which allows attackers to execute arbitrary code through malicious serialized objects. Deserialization of Untrusted Data vulnerability in sunshinephotocart Sunshine Photo Cart sunshine-photo-cart.1.1. Affected products include: Sunshinephotocart Sunshine Photo Cart.

RemediationAI

No vendor patch is available at time of analysis. Monitor vendor advisories for updates. Avoid deserializing untrusted data. Use safe serialization formats (JSON). Implement integrity checks and type allowlists.

More in Sunshine Photo Cart

View all
CVE-2024-30194 HIGH POC
7.1 Mar 27

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in sunshinephotocart

CVE-2024-43971 HIGH POC
7.1 Sep 18

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in sunshinephotocart

CVE-2026-16561 HIGH POC
7.5 Aug 05

Unauthenticated information disclosure in the Sunshine Photo Cart WordPress plugin (all versions before 3.6.12) allows a
CVE-2025-31084 CRITICAL
9.8 Apr 01

Deserialization of Untrusted Data vulnerability in sunshinephotocart Sunshine Photo Cart allows Object Injection.4.10. R
CVE-2026-85037 MEDIUM POC
5.3 Sep 09

Price manipulation via IDOR in Sunshine Photo Cart WordPress plugin before 3.7 allows unauthenticated shoppers to comple
CVE-2025-5482 HIGH
8.8 Jun 04

The Sunshine Photo Cart plugin for WordPress (versions ≤3.4.11) contains an improper key validation vulnerability in its
CVE-2024-47314 HIGH
7.1 Nov 01

Missing Authorization vulnerability in sunshinephotocart Sunshine Photo Cart sunshine-photo-cart allows Exploiting Incor
CVE-2026-42776 MEDIUM
6.3 May 25

Broken access control in the Sunshine Photo Cart WordPress plugin (versions through 3.6.7) allows authenticated low-priv
CVE-2026-57703 MEDIUM
6.3 Jul 23

Broken access control in Sunshine Photo Cart WordPress plugin (versions <= 3.6.10.1) enables subscriber-level authentica
CVE-2022-40692 MEDIUM
5.4 Feb 02

Cross-Site Request Forgery (CSRF) vulnerability in WP Sunshine Sunshine Photo Cart plugin <= 2.9.13 versions. Rated medi
CVE-2024-44038 MEDIUM
5.3 Nov 01

Missing Authorization vulnerability in sunshinephotocart Sunshine Photo Cart sunshine-photo-cart allows Exploiting Incor
CVE-2024-1294 MEDIUM
5.3 Feb 29

The Sunshine Photo Cart: Free Client Galleries for Photographers plugin for WordPress is vulnerable to Sensitive Informa

Same weakness CWE-502 – Deserialization of Untrusted Data

View all
CVE-2021-35464 CRITICAL POC
9.8
CVE-2020-10189 CRITICAL POC
9.8
CVE-2019-18935 CRITICAL POC
9.8
CVE-2015-7450 CRITICAL POC
9.8
CVE-2025-53770 CRITICAL POC
9.8
CVE-2020-7961 CRITICAL POC
9.8
CVE-2021-42237 CRITICAL POC
9.8
CVE-2025-24016 CRITICAL POC
9.9

Same technique Deserialization

View all
CVE-2015-7450 CRITICAL POC
9.8
CVE-2025-53770 CRITICAL POC
9.8
CVE-2020-7961 CRITICAL POC
9.8
CVE-2021-42237 CRITICAL POC
9.8
CVE-2025-24016 CRITICAL POC
9.9
CVE-2020-0618 HIGH POC
8.8
CVE-2015-4852 CRITICAL POC
9.8
CVE-2025-49113 CRITICAL POC
9.9

Share

CVE-2024-30221 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy