Iqonic Design vulnerabilities

We track 10 vulnerabilities in Iqonic Design products across 4 products. 10 are rated high or critical, and none are known to be exploited. The most recent was published on May 27, 2026.

10vulnerabilities

3critical

7high

0exploited

8.7average CVSS score

Latest Iqonic Design vulnerabilities

8.2 High severity
KiviCare: Authentication Bypass Using an Alternate Path or Channel
CVE-2026-42735May 27, 2026Iqonic Design
Authentication Bypass Using an Alternate Path or Channel vulnerability in Iqonic Design KiviCare kivicare-clinic-management-system allows Password Recovery Exploitation.This issue affects KiviCare: from n/a through <= 4.3.0.
7.1 High severity
KiviCare: Improper Neutralization of Input During Web Page Generation
CVE-2026-25383Mar 25, 2026Iqonic Design
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Iqonic Design KiviCare kivicare-clinic-management-system allows Reflected XSS.This issue affects KiviCare: from n/a through <= 3.6.16.
8.5 High severity
KiviCare: Improper Neutralization of Special Elements used in an SQL Command
CVE-2026-25022Feb 3, 2026Iqonic Design
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Iqonic Design KiviCare kivicare-clinic-management-system allows Blind SQL Injection.This issue affects KiviCare: from n/a through <= 3.6.16.
8.5 High severity
KiviCare: Improper Neutralization of Special Elements used in an SQL Command
CVE-2025-66095Nov 21, 2025Iqonic Design
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Iqonic Design KiviCare kivicare-clinic-management-system allows SQL Injection.This issue affects KiviCare: from n/a through <= 3.6.13.
8.5 High severity
WP Roadmap: Improper Neutralization of Special Elements used in an SQL Command
CVE-2025-52822Jun 20, 2025Iqonic Design
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Iqonic Design WP Roadmap wp-roadmap allows SQL Injection.This issue affects WP Roadmap: from n/a through <= 2.1.3.
8.1 High severity
Graphina: Cross-Site Request Forgery
CVE-2025-47533May 7, 2025Iqonic Design
Cross-Site Request Forgery (CSRF) vulnerability in Iqonic Design Graphina graphina-elementor-charts-and-graphs allows PHP Local File Inclusion.This issue affects Graphina: from n/a through <= 3.0.4.
9.8 Critical severity
WPBookit: Unrestricted Upload of File with Dangerous Type
CVE-2025-0357Jan 25, 2025Iqonic DesignEPSS 1.07%
The WPBookit plugin for WordPress is vulnerable to arbitrary file uploads due to insufficient file type validation in the 'WPB_Profile_controller::handle_image_upload' function in versions up to, and including, 1.6.9. This makes it possible for unauthenticated
9.8 Critical severity
WPBookit: Authorization Bypass Through User-Controlled Key
CVE-2024-10215Jan 9, 2025Iqonic Design
The WPBookit plugin for WordPress is vulnerable to Arbitrary User Password Change in versions up to, and including, 1.6.4. This is due to the plugin providing user-controlled access to objects, letting a user bypass authorization and access system resources. T
9.8 Critical severity
WPBookit: Improper Neutralization of Special Elements used in an SQL Command
CVE-2024-54280Dec 16, 2024Iqonic Design
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Iqonic Design WPBookit wpbookit allows SQL Injection.This issue affects WPBookit: from n/a through <= 1.6.0.
8.8 High severity
KiviCare: Missing Authorization
CVE-2024-35659Jun 8, 2024Iqonic Design
Missing Authorization vulnerability in Iqonic Design KiviCare kivicare-clinic-management-system allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects KiviCare: from n/a through <= 3.6.6.