Free tool
Is my WordPress plugin safe?
Type a plugin or theme and the version you run, and we’ll show every known vulnerability that affects it, from the 390,007 records in our vulnerability database. The version is listed under Plugins in your WordPress dashboard.
Plugin · kivicare-clinic-management-system
KiviCare
29 known vulnerabilities on record. Add your version above to see which ones affect you.
Sep 1, 2026KiviCare: Does not perform authorization checks on some of its REST endpointsCVE-2026-13611 · fixed in 4.5.5 · reported by WPScanMedium 5.3
The KiviCare WordPress plugin before 4.5.5 does not perform authorization checks on some of its REST endpoints, allowing unauthenticated attackers to disclose the patient roster and, when a payment gateway is configured, the payment gateway secret key.
Aug 19, 2026KiviCare: Does not verify that the requesting user is entitled to the media file being servedCVE-2026-19417 · fixed in 4.5.4 · reported by WPScanMedium 6.5
The KiviCare WordPress plugin before 4.5.4 does not verify that the requesting user is entitled to the media file being served, allowing authenticated patient-level users to download any file in the media library, including other patients' uploaded medical reports.
Aug 19, 2026KiviCare: Does not verify that the requesting user owns the appointment being modifiedCVE-2026-19416 · fixed in 4.5.4 · reported by WPScanMedium 4.3
The KiviCare WordPress plugin before 4.5.4 does not verify that the requesting user owns the appointment being modified, allowing authenticated patient-level users to cancel and reschedule other patients' appointments.
Aug 15, 2026KiviCare – Clinic & Patient Management System (EHR): Generic SQL InjectionCVE-2026-15453 · affects up to 4.5.1 · reported by WordfenceMedium 6.5
The KiviCare – Clinic & Patient Management System (EHR) plugin for WordPress is vulnerable to generic SQL Injection via the 'searchTerm' parameter in all versions up to, and including, 4.5.1 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for authenticated attackers, with custom-level access and above, to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database. Exploitation requires a KiviCare custom role with the 'settings_view' permission (e.g., Doctor or Receptionist), meaning standard WordPress subscribers cannot exploit this without a KiviCare-assigned role.
NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Aug 13, 2026KiviCare: Does not restrict the roles assignable through its unauthenticated registration endpointCVE-2026-13610 · fixed in 4.5.2 · reported by WPScanHigh 7.5
The KiviCare WordPress plugin before 4.5.2 does not restrict the roles assignable through its unauthenticated registration endpoint, allowing unauthenticated attackers to create an active, privileged clinic-staff (doctor) account with full access to patient records, billing and clinic data.
Aug 12, 2026KiviCare: Does not properly sanitise and escape user-supplied parameters before using them in a SQL queryCVE-2026-13613 · fixed in 4.5.2 · reported by WPScanHigh 8.8
The KiviCare WordPress plugin before 4.5.2 does not properly sanitise and escape user-supplied parameters before using them in a SQL query, allowing authenticated users with a clinic staff-level role to perform SQL injection.
Aug 12, 2026KiviCare: Does not verify that the requesting user owns the records being accessedCVE-2026-13612 · fixed in 4.5.2 · reported by WPScanMedium 4.3
The KiviCare WordPress plugin before 4.5.2 does not verify that the requesting user owns the records being accessed, allowing authenticated patient-level users to read other patients' bills, invoices and appointment details.
Jul 11, 2026KiviCare – Clinic & Patient Management System (EHR): Generic SQL InjectionCVE-2026-15073 · affects up to 4.5.0 · reported by WordfenceMedium 6.5
The KiviCare – Clinic & Patient Management System (EHR) plugin for WordPress is vulnerable to generic SQL Injection via the 'orderby' parameter in all versions up to, and including, 4.5.0 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for authenticated attackers, with Doctor-level access and above, to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database. Exploitation requires a KiviCare Doctor, Receptionist, or Clinic Admin role at minimum, as the vulnerable REST endpoint is restricted to authenticated users with custom plugin-level access.
NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Jul 11, 2026KiviCare – Clinic & Patient Management System (EHR): Generic SQL InjectionCVE-2026-15072 · affects up to 4.5.0 · reported by WordfenceMedium 6.5
The KiviCare – Clinic & Patient Management System (EHR) plugin for WordPress is vulnerable to generic SQL Injection via the 'orderby' parameter in all versions up to, and including, 4.5.0 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for authenticated attackers, with doctor-level access and above, to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database. This requires that the attacker hold at minimum a KiviCare Doctor-level account, or a Receptionist or Clinic Admin role that grants the doctor_session_list capability.
NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Jul 10, 2026KiviCare – Clinic & Patient Management System (EHR): Authorization bypassCVE-2026-11990 · affects up to 4.4.0 · reported by WordfenceMedium 5.3
The KiviCare – Clinic & Patient Management System (EHR) plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 4.4.0. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for unauthenticated attackers to mark arbitrary pending appointments as Confirmed and forge an associated completed payment record in wp_kc_payments_appointment_mappings using an attacker-supplied payment ID, bypassing payment entirely. This exploit is achievable on a default installation because the gateway resolution logic returns all registered gateways regardless of admin-enabled status, making the manual (KCPayLater) gateway always selectable.
NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Jun 15, 2026Subscriber Insecure Direct Object References (IDOR) in KiviCare <= 4.2.1 versions.CVE-2026-40792 · affects up to 4.2.1 · reported by PatchstackMedium 6.3
Subscriber Insecure Direct Object References (IDOR) in KiviCare <= 4.2.1 versions.
May 27, 2026KiviCare: Authentication Bypass Using an Alternate Path or ChannelCVE-2026-42735 · affects up to 4.3.0 · reported by PatchstackHigh 8.2
Authentication Bypass Using an Alternate Path or Channel vulnerability in Iqonic Design KiviCare kivicare-clinic-management-system allows Password Recovery Exploitation.This issue affects KiviCare: from n/a through <= 4.3.0.
Mar 25, 2026KiviCare: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2026-25383 · affects up to 3.6.16 · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Iqonic Design KiviCare kivicare-clinic-management-system allows Reflected XSS.This issue affects KiviCare: from n/a through <= 3.6.16.
Mar 25, 2026KiviCare: Missing AuthorizationCVE-2026-25034 · affects up to 3.6.16 · reported by PatchstackMedium 6.5
Missing Authorization vulnerability in Iqonic Design KiviCare kivicare-clinic-management-system allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects KiviCare: from n/a through <= 3.6.16.
Mar 18, 2026KiviCare – Clinic & Patient Management System (EHR): Privilege EscalationCVE-2026-2992 · affects up to 4.1.2 · reported by WordfenceHigh 8.2
The KiviCare – Clinic & Patient Management System (EHR) plugin for WordPress is vulnerable to Privilege Escalation due to missing authorization on the `/wp-json/kivicare/v1/setup-wizard/clinic` REST API endpoint in all versions up to, and including, 4.1.2. This makes it possible for unauthenticated attackers to create a new clinic and a WordPress user with clinic admin privileges.
NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Mar 18, 2026KiviCare – Clinic & Patient Management System (EHR): Authentication BypassCVE-2026-2991 · affects up to 4.1.2 · reported by WordfenceHigh 7.3
The KiviCare – Clinic & Patient Management System (EHR) plugin for WordPress is vulnerable to Authentication Bypass in all versions up to, and including, 4.1.2. This is due to the `patientSocialLogin()` function not verifying the social provider access token before authenticating a user. This makes it possible for unauthenticated attackers to log in as any patient registered on the system by providing only their email address and an arbitrary value for the access token, bypassing all credential verification. The attacker gains access to sensitive medical records, appointments, prescriptions, and billing information (PII/PHI breach). Additionally, authentication cookies are set before the role check, meaning the auth cookies for non-patient users (including administrators) are also set in the HTTP response headers, even though a 403 response is returned.
NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Feb 3, 2026KiviCare: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')CVE-2026-25022 · affects up to 3.6.16 · reported by PatchstackHigh 8.5
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Iqonic Design KiviCare kivicare-clinic-management-system allows Blind SQL Injection.This issue affects KiviCare: from n/a through <= 3.6.16.
Jan 23, 2026KiviCare – Clinic & Patient Management System (EHR): Arbitrary file uploadsCVE-2026-0927 · affects up to 3.6.15 · reported by WordfenceMedium 5.3
The KiviCare – Clinic & Patient Management System (EHR) plugin for WordPress is vulnerable to arbitrary file uploads due to missing authorization checks in the uploadMedicalReport() function in all versions up to, and including, 3.6.15. This makes it possible for unauthenticated attackers to upload text files and PDF documents to the affected site's server which may be leveraged for further attacks such as hosting malicious content or phishing pages via PDF files.
NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Nov 21, 2025KiviCare: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')CVE-2025-66095 · affects up to 3.6.13 · reported by PatchstackHigh 8.5
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Iqonic Design KiviCare kivicare-clinic-management-system allows SQL Injection.This issue affects KiviCare: from n/a through <= 3.6.13.
Feb 28, 2025KiviCare – Clinic & Patient Management System (EHR): SQL InjectionCVE-2025-1572 · affects up to 3.6.7 · reported by WordfenceMedium 6.5
The KiviCare – Clinic & Patient Management System (EHR) plugin for WordPress is vulnerable to SQL Injection via the ‘u_id’ parameter in all versions up to, and including, 3.6.7 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for authenticated attackers, with doctor-level access and above, to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.
NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Dec 6, 2024KiviCare – Clinic & Patient Management System (EHR): SQL InjectionCVE-2024-11730 · affects up to 3.6.4 · reported by WordfenceMedium 6.5
The KiviCare – Clinic & Patient Management System (EHR) plugin for WordPress is vulnerable to SQL Injection via the 'sort[]' parameter of the static_data_list AJAX action in all versions up to, and including, 3.6.4 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for authenticated attackers, with doctor/receptionist-level access and above, to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.
Dec 6, 2024KiviCare – Clinic & Patient Management System (EHR): SQL InjectionCVE-2024-11729 · affects up to 3.6.4 · reported by WordfenceMedium 6.5
The KiviCare – Clinic & Patient Management System (EHR) plugin for WordPress is vulnerable to SQL Injection via the 'service_list[0][service_id]' parameter of the get_widget_payment_options AJAX action in all versions up to, and including, 3.6.4 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for authenticated attackers, with Custom-level access and above, to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.
Dec 6, 2024KiviCare – Clinic & Patient Management System (EHR): SQL InjectionCVE-2024-11728 · affects up to 3.6.4 · reported by WordfenceHigh 7.5
The KiviCare – Clinic & Patient Management System (EHR) plugin for WordPress is vulnerable to SQL Injection via the 'visit_type[service_id]' parameter of the tax_calculated_data AJAX action in all versions up to, and including, 3.6.4 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for unauthenticated attackers to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.
Jun 8, 2024KiviCare: Missing AuthorizationCVE-2024-35659 · affects up to 3.6.6 · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in Iqonic Design KiviCare kivicare-clinic-management-system allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects KiviCare: from n/a through <= 3.6.6.
Jun 27, 2023KiviCare: Does not have CSRF checks (either flawed or missing completely) in various AJAX actionsCVE-2023-2628 · fixed in 3.2.1 · reported by WPScanHigh 8.8
The KiviCare WordPress plugin before 3.2.1 does not have CSRF checks (either flawed or missing completely) in various AJAX actions, which could allow attackers to make logged in users perform unwanted actions via CSRF attacks. This includes, but is not limited to: Delete arbitrary appointments/medical records/etc, create/update various users (patients, doctors etc)
Jun 27, 2023KiviCare: Does not have proper CSRF and authorisation checks in various AJAX actionsCVE-2023-2627 · fixed in 3.2.1 · reported by WPScanMedium 4.3
The KiviCare WordPress plugin before 3.2.1 does not have proper CSRF and authorisation checks in various AJAX actions, allowing any authenticated users, such as subscriber to call them. Attacks include but are not limited to: Add arbitrary Clinic Admin/Doctors/etc and update plugin's settings
Jun 27, 2023KiviCare: Does not sanitise and escape a parameter before outputting it back in the pageCVE-2023-2624 · fixed in 3.2.1 · reported by WPScanMedium 6.1
The KiviCare WordPress plugin before 3.2.1 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as administrator
Jun 27, 2023KiviCare: Does not restrict the information returned in a response and returns all user dataCVE-2023-2623 · fixed in 3.2.1 · reported by WPScanMedium 6.5
The KiviCare WordPress plugin before 3.2.1 does not restrict the information returned in a response and returns all user data, allowing low privilege users such as subscriber to retrieve sensitive information such as the user email and hashed password of other users
Jun 13, 2022KiviCare: Does not sanitise and escape some parameters before using them in SQL statements via the ajax_post AJAX action with the get_doctor_details routeCVE-2022-0786 · fixed in 2.3.9 · reported by WPScanCritical 9.8
The KiviCare WordPress plugin before 2.3.9 does not sanitise and escape some parameters before using them in SQL statements via the ajax_post AJAX action with the get_doctor_details route, leading to SQL Injections exploitable by unauthenticated users
Versions are matched against the affected ranges published with each record. A plugin can ship a fix under its own numbering, so if something looks off, check the linked record. Want the whole site checked at once? Run the free website check.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.