KiviCare – Clinic & Patient Management System (EHR)
KiviCare – Clinic & Patient Management System (EHR) has 29 disclosed vulnerabilities in the WordSec catalog, reported between 2022 and 2026; all 29 are fixed as of October 2026. Their average CVSS score is 6.2, and the most serious one scores 9.8 out of 10. Severity breakdown: 2 critical and 3 high. 2026 was the busiest year with 18 disclosures.
The most common weakness is SQL Injection, behind 11 of the records (38%). Other recurring categories include Missing Authorization, Exposure Of Sensitive Information To An Unauthorized Actor.
Every one of the 29 issues recorded for KiviCare – Clinic & Patient Management System (EHR) has a vendor fix available, so running the current release closes all known holes.
19 independent researchers contributed these findings, most of them (5) reported by Erwan LR. KiviCare – Clinic & Patient Management System (EHR) is installed on roughly 1,000 WordPress sites, so each unpatched flaw has a wide blast radius. The current release is tested up to WordPress 7.1.3.
CVE-2026-13610KiviCare – Clinic & Patient Management System (EHR) < 4.5.2 - Unauthenticated Privilege Escalation
Read the full analysisVulnerability Records

KiviCare – Clinic & Patient Management System (EHR)
Author
Iqonic Design
🚀 Launch Your Complete Online Clinic in 60 Seconds! KiviCare is the most advanced, self-hosted clinic and patient management solution (EHR) built for WordPress. Powered by React 19 and Bootstrap 5, KiviCare delivers a lightning-fast, modern interface that doesn’t feel like a typical WordPress plugin. NEW in Version 4.0: Complete UI/UX Redesign! After 3+ years of development and refinement, KiviCare now features a completely redesigned modern interface with improved performance, cleaner design, and enhanced user experience. It’s the only Medical EHR solution on WordPress that provides a pure MAGICAL EXPERIENCE comparable to modern SaaS applications. DEMO | PRO | WP Theme | Zoom Telemed | Google Meet Telemed | Mobile App | Docs A WordPress plugin that doesn’t feel like one. What’s New in Version 4.0 (The Big Redesign!) Modern Interface & Performance Completely Redesigned UI – Built with React 19 + Bootstrap 5 for a premium, modern look Lightning-Fast Performance – Lazy loading components and optimized rendering Smoother Navigation – Cleaner design with improved user experience Language Switcher – Easily change preferred language from the header Enhanced Scheduling Day-Wise Time Slots – Set unique availability for each day of the week Flexible Doctor Scheduling – Different time slots for different days Better Appointment Management – Streamlined booking flow Payment Flexibility NEW: KnitPay Integration – Support for 500+ payment gateways worldwide PayPal Integration – Accept online payments seamlessly WooCommerce Compatible – Full e-commerce integration (Pro) Technical Improvements WordPress REST API – Modern, reliable API architecture Action Scheduler Integration – Stable background processing for queued tasks Customizable Print Templates – Easy branding through child themes HTML Email Templates – Rich, beautiful email notifications Core Features Complete Clinic Management Built with React 19 – Zero page reloads, instant responses Appointment Booking System – Smart scheduling with conflict prevention Patient Records Management – Comprehensive patient history Encounter (Patient Visits) Management – Track every patient interaction Doctor Scheduling – Flexible session management Doctor Services – Service catalog with pricing Multi-Role User System Complete role-based access control: – Super Admin – Full system control – Clinic Admin – Clinic-level management – Doctor – Patient care and scheduling – Receptionist – Front desk operations – Patient – Self-service portal Patient Portal Patient Self-Service Portal – Book, manage, and view appointments Medical History Access – Patients can view their records Appointment Reminders – Email notifications Website Integration Powerful widgets & blocks for your website: – Booking Form / Button – [kivicareBookAppointmentButton] – Doctor List Widget – Showcase your medical team – Login/Register Page – [kivicareRegisterLogin] – Clinic List – Display multiple locations Configuration & Customization Email Reminders & Notifications – Automated patient communication Custom Email Templates – Brand your communications Custom Fields – Extend forms with custom data Powerful Settings Panel – Comprehensive configuration options Multilanguage Support – Translation-ready Insightful Dashboard – Real-time clinic overview Pro Features – Unlock Enterprise Power View KiviCare Pro Transform your clinic into a multi-location healthcare empire: Multi-Clinic Enterprise Multi-Clinic Setup – Manage unlimited clinics from one dashboard Centralized Administration – Control all locations effortlessly Clinic-Specific Settings – Customize each location independently Advanced Payments & E-Commerce WooCommerce Integration – Full e-commerce payment processing Multiple Payment Gateways – Maximum payment flexibility Revenue Reports – Track income across all clinics Professional Scheduling Google Calendar Integration – Two-way sync with Google Calendar Calendar Sharing – Share availability with colleagues Appointment Conflicts – Automatic conflict prevention Advanced Communication SMS Alerts via Twilio – Automated SMS notifications WhatsApp Alerts – WhatsApp appointment reminders Custom Notifications – Design your own notification templates Multi-Channel Communication – Reach patients on their preferred platform Telemedicine Ready Zoom Integration (Addon) – Virtual consultations with video Google Meet Integration (Addon) – Secure virtual visits One-Click Join – Seamless telehealth experience Business Intelligence Advanced Reports – Comprehensive clinic analytics Performance Metrics – Track KPIs and growth Export Data – CSV/Excel exports for analysis Premium Customization Advanced Styling Options – Match your clinic branding RTL Support – Right-to-left language support White Label Ready – Remove KiviCare branding KiviCare Premium Products Build a complete digital healthcare ecosystem: KiviCare Pro – Enterprise clinic management KiviCare WordPress Theme – Professional clinic website Zoom Telemed Addon – Video consultations Google Meet Telemed Addon – Secure telemed solution Flutter Mobile App – iOS & Android apps Professional Services Need expert help with setup, migration, or customization? 👉 Get a Quote from Our Experts Support & Resources Complete Documentation – Step-by-step guides Video Tutorials – Visual learning resources Community Support – Active user community Submit Feature Requests We listen carefully! Have an idea to make KiviCare better? 👉 Submit Your Feature Request You Are In Good Company KiviCare is crafted by IQONIC Design – a team of expert, young, and dynamic creators of community-focused digital products. Trusted by over 100,000+ individuals and businesses worldwide. More FREE Products from IQONIC We love our community! Check out our other amazing free products: Graphina – The most powerful Elementor charts and graphs plugin MARVY – Coolest background animations for Elementor WP Roadmap – Create product roadmaps and feedback boards Connect With Us on Social Media Instagram YouTube Dribbble Facebook Twitter Privacy KiviCare can optionally share data with IQonic Design (its developer) to support software updates and improve the plugin. All data sharing requires your explicit consent — nothing is collected by default. Installation data (optional): If you consent, KiviCare shares your site URL, plugin/WordPress/PHP version numbers, and plugin lifecycle events (activation, deactivation, uninstallation). If you choose to share a reason when deactivating KiviCare, that optional feedback text is included. Marketing email (optional, separate): If you consent, IQonic Design may send product updates and tips to your site admin email address (get_option('admin_email')). This is entirely independent of installation data sharing — you can accept one without the other. No patient, staff, or other end-user data collected by KiviCare is ever included in this telemetry. KiviCare works identically whether you accept or decline. You are prompted for consent on first activation and can change your preferences at any time under Settings > Privacy. Suggested privacy policy language is also available under Settings > Privacy.
Vulnerability data © Defiant, Inc., provided under the Wordfence Intelligence T&C