KiviCare – Clinic & Patient Management System (EHR) vulnerabilities

4 known vulnerabilities in KiviCare – Clinic & Patient Management System (EHR) from Iqonicdesign. 4 are rated high or critical. Each entry lists the affected versions and the release that fixes it, where the vendor has published one.

Latest first

• 8.2 High severity

  KiviCare – Clinic & Patient Management System…: Missing Authorization

  CVE-2026-2992Mar 18, 2026Iqonicdesign

  The KiviCare – Clinic & Patient Management System (EHR) plugin for WordPress is vulnerable to Privilege Escalation due to missing authorization on the `/wp-json/kivicare/v1/setup-wizard/clinic` REST API endpoint in all versions up to, and including, 4.1.2. Thi

• 7.3 High severity

  KiviCare – Clinic & Patient Management System…: Improper Authentication

  CVE-2026-2991Mar 18, 2026Iqonicdesign

  The KiviCare – Clinic & Patient Management System (EHR) plugin for WordPress is vulnerable to Authentication Bypass in all versions up to, and including, 4.1.2. This is due to the `patientSocialLogin()` function not verifying the social provider access token b

• 8.8 High severity

  KiviCare – Clinic & Patient Management System…: Improper Neutralization of Special Elements used in an SQL Command

  CVE-2025-1572Feb 28, 2025Iqonicdesign

  The KiviCare – Clinic & Patient Management System (EHR) plugin for WordPress is vulnerable to SQL Injection via the ‘u_id’ parameter in all versions up to, and including, 3.6.7 due to insufficient escaping on the user supplied parameter and lack of sufficient

• 7.5 High severity

  KiviCare – Clinic & Patient Management System…: Improper Neutralization of Special Elements used in an SQL Command

  CVE-2024-11728Dec 6, 2024IqonicdesignEPSS 13.6%

  The KiviCare – Clinic & Patient Management System (EHR) plugin for WordPress is vulnerable to SQL Injection via the 'visit_type[service_id]' parameter of the tax_calculated_data AJAX action in all versions up to, and including, 3.6.4 due to insufficient escapi