CVE-2024-30194 – This vulnerability allows attackers to inject m... (How to Fix)

Q: What is the severity of CVE-2024-30194?

CVE-2024-30194 has a CVSS score of 7.1 (HIGH). This vulnerability allows attackers to inject malicious scripts into web pages generated by the Sunshine Photo Cart WordPress plugin. When a user visits a specially crafted link, the script executes in their browser, potentially stealing session cookies or performing actions on their behalf. It affects all WordPress sites using Sunshine Photo Cart versions up to 3.1.1.

📋 TL;DR

This vulnerability allows attackers to inject malicious scripts into web pages generated by the Sunshine Photo Cart WordPress plugin. When a user visits a specially crafted link, the script executes in their browser, potentially stealing session cookies or performing actions on their behalf. It affects all WordPress sites using Sunshine Photo Cart versions up to 3.1.1.

💻 Affected Systems

Products:

Sunshine Photo Cart WordPress Plugin

Versions: n/a through 3.1.1

Operating Systems: All operating systems running WordPress

Default Config Vulnerable: ⚠️ Yes

Notes: All WordPress installations with vulnerable plugin versions are affected regardless of configuration.

📦 What is this software?

Sunshine Photo Cart by Sunshinephotocart

View all CVEs affecting Sunshine Photo Cart →

⚠️ Risk & Real-World Impact

🔴

Worst Case

Attackers could steal administrator session cookies, take over WordPress admin accounts, install backdoors, deface websites, or redirect users to malicious sites.

🟠

Likely Case

Attackers typically use this to steal user session cookies, perform phishing attacks, or redirect users to malicious content.

🟢

If Mitigated

With proper input validation and output encoding, the malicious scripts would be neutralized before reaching users' browsers.

🌐 Internet-Facing: HIGH

🏢 Internal Only: MEDIUM

🎯 Exploit Status

Public PoC: ⚠️ Yes

Weaponized: LIKELY

Unauthenticated Exploit: ⚠️ Yes

Complexity: LOW

Reflected XSS vulnerabilities are commonly exploited and require minimal technical skill.

🛠️ Fix & Mitigation

✅ Official Fix

Patch Version: 3.1.2 or later

Vendor Advisory: https://patchstack.com/database/vulnerability/sunshine-photo-cart/wordpress-sunshine-photo-cart-plugin-3-1-1-reflected-cross-site-scripting-xss-vulnerability?_s_id=cve

Restart Required: No

Instructions:

1. Log into WordPress admin panel. 2. Navigate to Plugins > Installed Plugins. 3. Find Sunshine Photo Cart and click 'Update Now'. 4. Verify version is 3.1.2 or higher.

🔧 Temporary Workarounds

Disable vulnerable plugin

all

Temporarily disable Sunshine Photo Cart until patched

wp plugin deactivate sunshine-photo-cart

Implement WAF rules

all

Add web application firewall rules to block XSS payloads

🧯 If You Can't Patch

Implement Content Security Policy (CSP) headers to restrict script execution
Use browser security extensions that block XSS attacks

🔍 How to Verify

Check if Vulnerable:

Check WordPress admin panel > Plugins > Installed Plugins for Sunshine Photo Cart version

Check Version:

wp plugin get sunshine-photo-cart --field=version

Verify Fix Applied:

Verify plugin version is 3.1.2 or higher in WordPress admin

📡 Detection & Monitoring

Log Indicators:

Unusual GET/POST requests with script tags or JavaScript in parameters
Multiple failed login attempts after suspicious URL visits

Network Indicators:

HTTP requests containing <script> tags or JavaScript in query parameters
Unusual outbound connections after visiting specific URLs

SIEM Query:

source="web_server" AND (url="*<script>*" OR url="*javascript:*" OR url="*onerror=*" OR url="*onload=*")

📊 Metadata

CVE ID: CVE-2024-30194

CVSS v3 Score: 7.1 (HIGH)

CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L

CWE: CWE-79

Published: March 27, 2024

Last Updated: April 8, 2025

🔗 References

📤 Share & Export

📄 Export Markdown 📋 Export JSON

🔗 Related Vulnerabilities

If you're affected by CVE-2024-30194, you might also want to check these: