Not rated
CVE-2023-2624 The KiviCare WordPress plugin before 3.2.1 does not sanitise and escape a parameter before outputting it back in the…
Description
The KiviCare WordPress plugin before 3.2.1 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as administrator
Affected products and versions
| Product | Affected versions | Fixed in |
|---|---|---|
| KiviCare 3.2 | earliest → < 3.2.1 | 3.2.1 |
References
- wpscan.com wpscan.com
- packetstormsecurity.com packetstormsecurity.com
Timeline
- Published
- Last modified
Other CVEs of KiviCare
The 10 CVEs of KiviCare →
CVE-2026-13611
The KiviCare WordPress plugin before 4.5.5 does not perform authorization checks on some of its REST endpoints, allowing…
5.3
Medium
CVE-2026-19417
The KiviCare WordPress plugin before 4.5.4 does not verify that the requesting user is entitled to the media file being…
6.5
Medium
CVE-2026-19416
The KiviCare WordPress plugin before 4.5.4 does not verify that the requesting user owns the appointment being…
4.3
Medium
CVE-2026-13610
The KiviCare WordPress plugin before 4.5.2 does not restrict the roles assignable through its unauthenticated…
7.5
High