CVE-2026-93617

HighCVSS 7.2/10Last modified Oct 6, 2026

Description

Deserialization of Untrusted Data vulnerability in WP Sunshine Sunshine Photo Cart sunshine-photo-cart allows Object Injection.This issue affects Sunshine Photo Cart: from n/a through 3.7.1.

Metrics

CVSS 3.1 7.2/10CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-502

Affected software

Vendor	Product	Versions
WP Sunshine	Sunshine Photo Cart	<= 3.7.1

References

https://patchstack.com/database/wordpress/plugin/sunshine-photo-cart/vulnerability/wordpress-sunshine-photo-cart-plugin-3-7-1-php-object-injection-vulnerability?_s_id=cve

Timeline

Published: Oct 5, 2026
Last modified: Oct 6, 2026
NVD status: Deferred

Related CVEs from 2026

CVE-2026-936186.5Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Crocoblock. Jetimpex Inc. JetTricks al CVE-2026-93626.3A security vulnerability has been detected in Edimax EW-7438RPn 1.12. This vulnerability affects the function formConnectionSetting of the f CVE-2026-936206.5Unauthenticated Broken Access Control in PayPlus Payment Gateway <= 8.2.5 versions.CVE-2026-936218.2Unauthenticated SQL Injection in WP Data Access <= 5.5.84 versions.CVE-2026-936227.1Unauthenticated Cross Site Scripting (XSS) in WPS Limit Login <= 1.5.9.3 versions.CVE-2026-936235.3Unauthenticated Insecure Direct Object References (IDOR) in AI Engine <= 3.7.8 versions.CVE-2026-936247.2Shop manager PHP Object Injection in Music Player for WooCommerce <= 1.9.1 versions.CVE-2026-936275.3An organizer authentication vulnerability in the email calendar processing of Zimbra Collaboration Suite (ZCS) allows an unauthenticated sen CVE-2026-936285.3An attendee authentication vulnerability in the email calendar processing of Zimbra Collaboration Suite (ZCS) allows an unauthenticated send CVE-2026-936295.3An organizer authentication vulnerability in Zimbra Collaboration Suite (ZCS) allows an unauthenticated email sender to insert calendar invi CVE-2026-93636.3A vulnerability was detected in Edimax EW-7438RPn 1.12. This issue affects the function formEZCHNwlanSetup of the file /goform/formEZCHNwlan CVE-2026-936304.3A hostname canonicalization vulnerability in the email HTML sanitizers of Zimbra Collaboration Suite (ZCS) allows an unauthenticated sender