WordPress plugin
KiviCare – Clinic & Patient Management System (EHR) security & vulnerabilities
No known unpatched vulnerabilities in the latest version
All 29 known vulnerabilities are fixed in the latest release. If you run an older version, update to null or newer.
- Critical2
- High3
- Medium24
- Low0
All KiviCare – Clinic & Patient Management System (EHR) vulnerabilities
| Severity | Vulnerability | CVE | Published |
|---|---|---|---|
| Medium5.3 | Unauthenticated Information Exposure ≤4.5.4Update to 4.5.5 | CVE-2026-13611 | |
| Medium4.3 | Missing Authorization <4.5.4Update to 4.5.4 | CVE-2026-19417 | |
| Medium4.3 | Missing Authorization <4.5.4Update to 4.5.4 | CVE-2026-19416 | |
| Medium6.5 | Authenticated (Doctor+) SQL Injection via 'searchTerm' Parameter ≤4.5.1Update to 4.5.2 | CVE-2026-15453 | |
| Critical9.8 | Unauthenticated Privilege Escalation <4.5.2Update to 4.5.2 | CVE-2026-13610 | |
| Medium4.3 | Authenticated (Custom role+) Information Exposure <4.5.2Update to 4.5.2 | CVE-2026-13612 | |
| Medium6.5 | Authenticated (Authenticated+) SQL Injection ≤4.5.1Update to 4.5.2 | CVE-2026-13613 | |
| Medium6.5 | Authenticated (Doctor+) SQL Injection via 'orderby' Parameter in KCQueryBuilder ≤4.5.0Update to 4.5.1 | CVE-2026-15072 | |
| Medium6.5 | Authenticated (Doctor+) SQL Injection via 'orderby' Parameter in DoctorSessionController ≤4.5.0Update to 4.5.1 | CVE-2026-15073 | |
| Medium5.3 | Missing Authorization to Unauthenticated Payment Bypass and Appointment Status Manipulation via /payment-success REST Endpoint ≤4.4.0Update to 4.5.0 | CVE-2026-11990 | |
| Medium5.3 | Missing Authorization ≤4.3.0Update to 4.4.0 | CVE-2026-42735 | |
| Medium4.3 | Authenticated (Subscriber+) Insecure Direct Object Reference ≤4.2.1Update to 4.3.0 | CVE-2026-40792 | |
| Medium5.3 | Missing Authorization ≤3.6.16Update to 4.0.0 | CVE-2026-25034 | |
| Medium6.1 | Reflected Cross-Site Scripting ≤3.6.16Update to 4.0.0 | CVE-2026-25383 | |
| High8.2 | Missing Authorization to Unauthenticated Privilege Escalation via Setup Wizard ≤4.1.2Update to 4.1.3 | CVE-2026-2992 | |
| High7.3 | Unauthenticated Authentication Bypass via Social Login Token ≤4.1.2Update to 4.1.3 | CVE-2026-2991 | |
| Medium6.5 | Authenticated (Receptionist+) SQL Injection ≤3.6.16Update to 4.0.0 | CVE-2026-25022 | |
| Medium5.3 | Missing Authorization to Unauthenticated Limited Arbitrary File Upload ≤3.6.15Update to 3.6.16 | CVE-2026-0927 | |
| Medium6.5 | Authenticated (Patient+) SQL Injection ≤3.6.13Update to 3.6.14 | CVE-2025-66095 | |
| Medium6.5 | Authenticated (Doctor+) SQL Injection via 'u_id' Parameter ≤3.6.7Update to 3.6.8 | CVE-2025-1572 | |
| Medium6.5 | Authenticated (Doctor/Receptionist+) SQL Injection ≤3.6.4Update to 3.6.5 | CVE-2024-11730 | |
| High7.5 | Unauthenticated SQL Injection ≤3.6.4Update to 3.6.5 | CVE-2024-11728 | |
| Medium6.5 | Authenticated (Subscriber+) SQL Injection ≤3.6.4Update to 3.6.5 | CVE-2024-11729 | |
| Medium4.3 | Authenticated (Patient+) Insecure Direct Object Reference ≤3.6.6Update to 3.6.7 | CVE-2024-35659 | |
| Medium6.1 | Reflected Cross-Site Scripting via 'filterType' <3.2.1Update to 3.2.1 | CVE-2023-2624 | |
| Medium6.5 | Cross-Site Request Forgery ≤3.2.0Update to 3.2.1 | CVE-2023-2628 | |
| Medium5.4 | Missing Authorization ≤3.2.0Update to 3.2.1 | CVE-2023-2627 | |
| Medium6.5 | Sensitive Information Exposure 3.2.0 – 3.2.0Update to 3.2.1 | CVE-2023-2623 | |
| Critical9.8 | SQL Injection ≤2.3.8Update to 2.3.9 | CVE-2022-0786 |
- Medium5.3Unauthenticated Information Exposure
≤4.5.4Update to 4.5.5
- Medium4.3Missing Authorization
<4.5.4Update to 4.5.4
- Medium4.3Missing Authorization
<4.5.4Update to 4.5.4
- Medium6.5Authenticated (Doctor+) SQL Injection via 'searchTerm' Parameter
≤4.5.1Update to 4.5.2
- Critical9.8Unauthenticated Privilege Escalation
<4.5.2Update to 4.5.2
- Medium4.3Authenticated (Custom role+) Information Exposure
<4.5.2Update to 4.5.2
- Medium6.5Authenticated (Authenticated+) SQL Injection
≤4.5.1Update to 4.5.2
- Medium6.5Authenticated (Doctor+) SQL Injection via 'orderby' Parameter in KCQueryBuilder
≤4.5.0Update to 4.5.1
- Medium6.5Authenticated (Doctor+) SQL Injection via 'orderby' Parameter in DoctorSessionController
≤4.5.0Update to 4.5.1
- Medium5.3Missing Authorization to Unauthenticated Payment Bypass and Appointment Status Manipulation via /payment-success REST Endpoint
≤4.4.0Update to 4.5.0
- Medium5.3Missing Authorization
≤4.3.0Update to 4.4.0
- Medium4.3Authenticated (Subscriber+) Insecure Direct Object Reference
≤4.2.1Update to 4.3.0
- Medium5.3Missing Authorization
≤3.6.16Update to 4.0.0
- Medium6.1Reflected Cross-Site Scripting
≤3.6.16Update to 4.0.0
- High8.2Missing Authorization to Unauthenticated Privilege Escalation via Setup Wizard
≤4.1.2Update to 4.1.3
- High7.3Unauthenticated Authentication Bypass via Social Login Token
≤4.1.2Update to 4.1.3
- Medium6.5Authenticated (Receptionist+) SQL Injection
≤3.6.16Update to 4.0.0
- Medium5.3Missing Authorization to Unauthenticated Limited Arbitrary File Upload
≤3.6.15Update to 3.6.16
- Medium6.5Authenticated (Patient+) SQL Injection
≤3.6.13Update to 3.6.14
- Medium6.5Authenticated (Doctor+) SQL Injection via 'u_id' Parameter
≤3.6.7Update to 3.6.8
- Medium6.5Authenticated (Doctor/Receptionist+) SQL Injection
≤3.6.4Update to 3.6.5
- High7.5Unauthenticated SQL Injection
≤3.6.4Update to 3.6.5
- Medium6.5Authenticated (Subscriber+) SQL Injection
≤3.6.4Update to 3.6.5
- Medium4.3Authenticated (Patient+) Insecure Direct Object Reference
≤3.6.6Update to 3.6.7
- Medium6.1Reflected Cross-Site Scripting via 'filterType'
<3.2.1Update to 3.2.1
- Medium6.5Cross-Site Request Forgery
≤3.2.0Update to 3.2.1
- Medium5.4Missing Authorization
≤3.2.0Update to 3.2.1
- Medium6.5Sensitive Information Exposure
3.2.0 – 3.2.0Update to 3.2.1
- Critical9.8SQL Injection
≤2.3.8Update to 2.3.9
KiviCare – Clinic & Patient Management System (EHR): common questions
Does KiviCare – Clinic & Patient Management System (EHR) have known vulnerabilities?
Yes. VulnCrest Radar lists 29 known vulnerabilities in KiviCare – Clinic & Patient Management System (EHR): 2 critical, 3 high, 24 medium. None are known to affect version null.
How do I check which version of KiviCare – Clinic & Patient Management System (EHR) I run?
In wp-admin open Plugins → Installed Plugins; the version is shown under the name. Without admin access, our passive Check my site tool can often read it from public files.
What is the most recent KiviCare – Clinic & Patient Management System (EHR) vulnerability?
CVE-2026-13611, published Aug 28, 2026: KiviCare – Clinic & Patient Management System (EHR) <= 4.5.4 - Unauthenticated Information Exposure. Severity: Medium (CVSS 5.3).
Is any KiviCare – Clinic & Patient Management System (EHR) vulnerability listed in CISA KEV?
No. None of the known KiviCare – Clinic & Patient Management System (EHR) vulnerabilities is currently listed in the CISA KEV catalog.