Kivicare (Unknown) - vulnerabilities (CVEs)
10 CVEs, 0 in the last 30 days, 2 known versions, newest CVE from 2026-09-01. Vendor: Unknown.
CVEs of Kivicare
- CVE-2026-13611 - CVSS 5.3 (medium), 2026-09-01: The KiviCare WordPress plugin before 4.5.5 does not perform authorization checks on some of its REST endpoints, allowing unauthenticated attackers to disclose…
- CVE-2026-19417 - CVSS 6.5 (medium), 2026-08-19: The KiviCare WordPress plugin before 4.5.4 does not verify that the requesting user is entitled to the media file being served, allowing authenticated…
- CVE-2026-19416 - CVSS 4.3 (medium), 2026-08-19: The KiviCare WordPress plugin before 4.5.4 does not verify that the requesting user owns the appointment being modified, allowing authenticated patient-level…
- CVE-2026-13610 - CVSS 7.5 (high), 2026-08-13: The KiviCare WordPress plugin before 4.5.2 does not restrict the roles assignable through its unauthenticated registration endpoint, allowing unauthenticated…
- CVE-2026-13613 - CVSS 8.8 (high), 2026-08-12: The KiviCare WordPress plugin before 4.5.2 does not properly sanitise and escape user-supplied parameters before using them in a SQL query, allowing…
- CVE-2026-13612 - CVSS 4.3 (medium), 2026-08-12: The KiviCare WordPress plugin before 4.5.2 does not verify that the requesting user owns the records being accessed, allowing authenticated patient-level…
- CVE-2023-2627 - CVSS 4.3 (medium), 2023-06-27: The KiviCare WordPress plugin before 3.2.1 does not have proper CSRF and authorisation checks in various AJAX actions, allowing any authenticated users, such…
- CVE-2023-2624 - CVSS 6.1 (medium), 2023-06-27: The KiviCare WordPress plugin before 3.2.1 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site…
- CVE-2023-2628 - CVSS 8.8 (high), 2023-06-27: The KiviCare WordPress plugin before 3.2.1 does not have CSRF checks (either flawed or missing completely) in various AJAX actions, which could allow…
- CVE-2023-2623 - CVSS 6.5 (medium), 2023-06-27: The KiviCare WordPress plugin before 3.2.1 does not restrict the information returned in a response and returns all user data, allowing low privilege users…
