8.8
High
CVE-2026-13613 The KiviCare WordPress plugin before 4.5.2 does not properly sanitise and escape user-supplied parameters before…
Description
The KiviCare WordPress plugin before 4.5.2 does not properly sanitise and escape user-supplied parameters before using them in a SQL query, allowing authenticated users with a clinic staff-level role to perform SQL injection.
Affected products and versions
| Product | Affected versions | Fixed in |
|---|---|---|
| KiviCare 4.5 | earliest → < 4.5.2 | 4.5.2 |
Other CVEs of KiviCare
The 10 CVEs of KiviCare →
CVE-2026-13611
The KiviCare WordPress plugin before 4.5.5 does not perform authorization checks on some of its REST endpoints, allowing…
5.3
Medium
CVE-2026-19417
The KiviCare WordPress plugin before 4.5.4 does not verify that the requesting user is entitled to the media file being…
6.5
Medium
CVE-2026-19416
The KiviCare WordPress plugin before 4.5.4 does not verify that the requesting user owns the appointment being…
4.3
Medium
CVE-2026-13610
The KiviCare WordPress plugin before 4.5.2 does not restrict the roles assignable through its unauthenticated…
7.5
High