KiviCare – Clinic & Patient Management System (EHR)

Wordfence Intelligence   >   Vulnerability Database   >   WordPress Plugins   >   KiviCare – Clinic & Patient Management System (EHR)

Information

Software Type Plugin
Software Slug kivicare-clinic-management-system (view on wordpress.org)
Software Status Active
Software Author iqonicdesign
Software Website kivicare.io
Software Downloads 123,823
Software Active Installs 2,000
Software Record Last Updated July 16, 2026

Showing 1-20 of 22 Vulnerabilities

Submit a Vulnerability
KiviCare <= 4.5.0 - Authenticated (Doctor+) SQL Injection via 'orderby' Parameter in KCQueryBuilder
6.5
CVE-2026-15072
Jul 10, 2026
Researcher: PRISM
KiviCare <= 4.5.0 - Authenticated (Doctor+) SQL Injection via 'orderby' Parameter in DoctorSessionController
6.5
CVE-2026-15073
Jul 10, 2026
Researcher: PRISM
KiviCare <= 4.4.0 - Missing Authorization to Unauthenticated Payment Bypass and Appointment Status Manipulation via /payment-success REST Endpoint
5.3
CVE-2026-11990
Jul 9, 2026
Researcher: Niv Kochan
KiviCare – Clinic & Patient Management System (EHR) <= 4.3.0 - Missing Authorization
5.3
CVE-2026-42735
May 26, 2026
Researcher: kai63001
KiviCare – Clinic & Patient Management System (EHR) <= 4.2.1 - Authenticated (Subscriber+) Insecure Direct Object Reference
4.3
CVE-2026-40792
Apr 23, 2026
Researcher: Jakub Herman
KiviCare – Clinic & Patient Management System (EHR) <= 3.6.16 - Missing Authorization
5.3
CVE-2026-25034
Mar 23, 2026
Researcher: andrea bocchetti
KiviCare – Clinic & Patient Management System (EHR) <= 3.6.16 - Reflected Cross-Site Scripting
6.1
CVE-2026-25383
Mar 23, 2026
Researcher: johska
KiviCare <= 4.1.2 - Missing Authorization to Unauthenticated Privilege Escalation via Setup Wizard
8.2
CVE-2026-2992
Mar 17, 2026
Researchers: Athiwat Tiprasaharn (Jitlada), Itthidej Aramsri (Boeing777)
KiviCare – Clinic & Patient Management System (EHR) <= 4.1.2 - Unauthenticated Authentication Bypass via Social Login Token
7.3
CVE-2026-2991
Mar 17, 2026
Researcher: Gibran Abdillah
KiviCare <= 3.6.16 - Authenticated (Receptionist+) SQL Injection
6.5
CVE-2026-25022
Feb 1, 2026
Researcher: alakinnn
KiviCare – Clinic & Patient Management System (EHR) <= 3.6.15 - Missing Authorization to Unauthenticated Limited Arbitrary File Upload
5.3
CVE-2026-0927
Jan 22, 2026
Researcher: Sarawut Poolkhet (MisterHelloz)
KiviCare <= 3.6.13 - Authenticated (Patient+) SQL Injection
6.5
CVE-2025-66095
Nov 27, 2025
Researcher: benzdeus
KiviCare – Clinic & Patient Management System (EHR) <= 3.6.7 - Authenticated (Doctor+) SQL Injection via 'u_id' Parameter
6.5
CVE-2025-1572
Feb 27, 2025
Researcher: wesley (wcraft)
KiviCare – Clinic & Patient Management System (EHR) <= 3.6.4 - Authenticated (Doctor/Receptionist+) SQL Injection
6.5
CVE-2024-11730
Dec 5, 2024
Researcher: shaman0x01
KiviCare – Clinic & Patient Management System (EHR) <= 3.6.4 - Authenticated (Subscriber+) SQL Injection
6.5
CVE-2024-11729
Dec 5, 2024
Researcher: shaman0x01
KiviCare – Clinic & Patient Management System (EHR) <= 3.6.4 - Unauthenticated SQL Injection
7.5
CVE-2024-11728
Dec 5, 2024
Researcher: shaman0x01
KiviCare <= 3.6.6 - Authenticated (Patient+) Insecure Direct Object Reference
4.3
CVE-2024-35659
Jun 3, 2024
Researcher: Van Lyubov
KiviCare <= 3.2.0 - Reflected Cross-Site Scripting via 'filterType'
6.1
CVE-2023-2624
Jun 5, 2023
Researcher: Arvandy
KiviCare – Clinic & Patient Management System (EHR) <= 3.2.0 - Cross-Site Request Forgery
6.5
CVE-2023-2628
Jun 5, 2023
Researcher: Erwan LR
KiviCare – Clinic & Patient Management System (EHR) <= 3.2.0 - Sensitive Information Exposure
6.5
CVE-2023-2623
Jun 5, 2023
Researcher: Erwan LR
Title Status CVE ID CVSS Researchers Date
KiviCare <= 4.5.0 - Authenticated (Doctor+) SQL Injection via 'orderby' Parameter in KCQueryBuilder Patched CVE-2026-15072 6.5 PRISM July 10, 2026
KiviCare <= 4.5.0 - Authenticated (Doctor+) SQL Injection via 'orderby' Parameter in DoctorSessionController Patched CVE-2026-15073 6.5 PRISM July 10, 2026
KiviCare <= 4.4.0 - Missing Authorization to Unauthenticated Payment Bypass and Appointment Status Manipulation via /payment-success REST Endpoint Patched CVE-2026-11990 5.3 Niv Kochan July 9, 2026
KiviCare – Clinic & Patient Management System (EHR) <= 4.3.0 - Missing Authorization Patched CVE-2026-42735 5.3 kai63001 May 26, 2026
KiviCare – Clinic & Patient Management System (EHR) <= 4.2.1 - Authenticated (Subscriber+) Insecure Direct Object Reference Patched CVE-2026-40792 4.3 Jakub Herman April 23, 2026
KiviCare – Clinic & Patient Management System (EHR) <= 3.6.16 - Missing Authorization Patched CVE-2026-25034 5.3 andrea bocchetti March 23, 2026
KiviCare – Clinic & Patient Management System (EHR) <= 3.6.16 - Reflected Cross-Site Scripting Patched CVE-2026-25383 6.1 johska March 23, 2026
KiviCare <= 4.1.2 - Missing Authorization to Unauthenticated Privilege Escalation via Setup Wizard Patched CVE-2026-2992 8.2 Athiwat Tiprasaharn (Jitlada), Itthidej Aramsri (Boeing777) March 17, 2026
KiviCare – Clinic & Patient Management System (EHR) <= 4.1.2 - Unauthenticated Authentication Bypass via Social Login Token Patched CVE-2026-2991 7.3 Gibran Abdillah March 17, 2026
KiviCare <= 3.6.16 - Authenticated (Receptionist+) SQL Injection Patched CVE-2026-25022 6.5 alakinnn February 1, 2026
KiviCare – Clinic & Patient Management System (EHR) <= 3.6.15 - Missing Authorization to Unauthenticated Limited Arbitrary File Upload Patched CVE-2026-0927 5.3 Sarawut Poolkhet (MisterHelloz) January 22, 2026
KiviCare <= 3.6.13 - Authenticated (Patient+) SQL Injection Patched CVE-2025-66095 6.5 benzdeus November 27, 2025
KiviCare – Clinic & Patient Management System (EHR) <= 3.6.7 - Authenticated (Doctor+) SQL Injection via 'u_id' Parameter Patched CVE-2025-1572 6.5 wesley (wcraft) February 27, 2025
KiviCare – Clinic & Patient Management System (EHR) <= 3.6.4 - Authenticated (Doctor/Receptionist+) SQL Injection Patched CVE-2024-11730 6.5 shaman0x01 December 5, 2024
KiviCare – Clinic & Patient Management System (EHR) <= 3.6.4 - Authenticated (Subscriber+) SQL Injection Patched CVE-2024-11729 6.5 shaman0x01 December 5, 2024
KiviCare – Clinic & Patient Management System (EHR) <= 3.6.4 - Unauthenticated SQL Injection Patched CVE-2024-11728 7.5 shaman0x01 December 5, 2024
KiviCare <= 3.6.6 - Authenticated (Patient+) Insecure Direct Object Reference Patched CVE-2024-35659 4.3 Van Lyubov June 3, 2024
KiviCare <= 3.2.0 - Reflected Cross-Site Scripting via 'filterType' Patched CVE-2023-2624 6.1 Arvandy June 5, 2023
KiviCare – Clinic & Patient Management System (EHR) <= 3.2.0 - Cross-Site Request Forgery Patched CVE-2023-2628 6.5 Erwan LR June 5, 2023
KiviCare – Clinic & Patient Management System (EHR) <= 3.2.0 - Sensitive Information Exposure Patched CVE-2023-2623 6.5 Erwan LR June 5, 2023

Did you know Wordfence Intelligence provides free personal and commercial API access to our comprehensive WordPress vulnerability database, along with a free webhook integration to stay on top of the latest vulnerabilities added and updated in the database? Get started today!

Learn more

Want to get notified of the latest vulnerabilities that may affect your WordPress site?
Install Wordfence on your site today to get notified immediately if your site is affected by a vulnerability that has been added to our database.

Get Wordfence

The Wordfence Intelligence WordPress vulnerability database is completely free to access and query via API. Please review the documentation on how to access and consume the vulnerability data via API.

Documentation