Skip to content
fr Sign in
8.8 High

CVE-2026-13613 The KiviCare WordPress plugin before 4.5.2 does not properly sanitise and escape user-supplied parameters before…

Description

The KiviCare WordPress plugin before 4.5.2 does not properly sanitise and escape user-supplied parameters before using them in a SQL query, allowing authenticated users with a clinic staff-level role to perform SQL injection.

Affected products and versions

Product Affected versions Fixed in
KiviCare 4.5 earliest → < 4.5.2 4.5.2

References

Timeline

  1. Published
  2. Last modified

Other CVEs of KiviCare

The 10 CVEs of KiviCare →
CVE-2026-13611 The KiviCare WordPress plugin before 4.5.5 does not perform authorization checks on some of its REST endpoints, allowing… 5.3 Medium CVE-2026-19417 The KiviCare WordPress plugin before 4.5.4 does not verify that the requesting user is entitled to the media file being… 6.5 Medium CVE-2026-19416 The KiviCare WordPress plugin before 4.5.4 does not verify that the requesting user owns the appointment being… 4.3 Medium CVE-2026-13610 The KiviCare WordPress plugin before 4.5.2 does not restrict the roles assignable through its unauthenticated… 7.5 High
Track this CVE