KiviCare – Clinic & Patient Management System (EHR)

KiviCare – Clinic & Patient Management System (EHR) has 29 disclosed vulnerabilities in the WordSec catalog, reported between 2022 and 2026; all 29 are fixed as of September 2026. Their average CVSS score is 6.2, and the most serious one scores 9.8 out of 10. Severity breakdown: 2 critical and 3 high. 2026 was the busiest year with 18 disclosures.

The most common weakness is SQL Injection, behind 11 of the records (38%). Other recurring categories include Missing Authorization, Exposure Of Sensitive Information To An Unauthorized Actor.

Every one of the 29 issues recorded for KiviCare – Clinic & Patient Management System (EHR) has a vendor fix available, so running the current release closes all known holes.

19 independent researchers contributed these findings, most of them (5) reported by Erwan LR. KiviCare – Clinic & Patient Management System (EHR) is installed on roughly 1,000 WordPress sites, so each unpatched flaw has a wide blast radius. The current release is tested up to WordPress 7.0.0.

01234567891022.10.2020Today23.05.20229.8KiviCare – Clinic & Patient Management System (EHR) <= 2.3.8 - SQL Injection CVSS 9.8 · 23.05.202205.06.20236.1KiviCare <= 3.2.0 - Reflected Cross-Site Scripting via 'filterType' CVSS 6.1 · 05.06.20236.5KiviCare – Clinic & Patient Management System (EHR) <= 3.2.0 - Cross-Site Request Forgery CVSS 6.5 · 05.06.20236.5KiviCare – Clinic & Patient Management System (EHR) <= 3.2.0 - Sensitive Information Exposure CVSS 6.5 · 05.06.20235.4KiviCare – Clinic & Patient Management System (EHR) <= 3.2.0 - Missing Authorization CVSS 5.4 · 05.06.202303.06.20244.3KiviCare <= 3.6.6 - Authenticated (Patient+) Insecure Direct Object Reference CVSS 4.3 · 03.06.202405.12.20246.5KiviCare – Clinic & Patient Management System (EHR) <= 3.6.4 - Authenticated (Doctor/Receptionist+) SQL Injection CVSS 6.5 · 05.12.20246.5KiviCare – Clinic & Patient Management System (EHR) <= 3.6.4 - Authenticated (Subscriber+) SQL Injection CVSS 6.5 · 05.12.20247.5KiviCare – Clinic & Patient Management System (EHR) <= 3.6.4 - Unauthenticated SQL Injection CVSS 7.5 · 05.12.202427.02.20256.5KiviCare – Clinic & Patient Management System (EHR) <= 3.6.7 - Authenticated (Doctor+) SQL Injection via 'u_id' Parameter CVSS 6.5 · 27.02.202527.11.20256.5KiviCare <= 3.6.13 - Authenticated (Patient+) SQL Injection CVSS 6.5 · 27.11.202522.01.20265.3KiviCare – Clinic & Patient Management System (EHR) <= 3.6.15 - Missing Authorization to Unauthenticated Limited Arbitrary File Upload CVSS 5.3 · 22.01.202601.02.20266.5KiviCare <= 3.6.16 - Authenticated (Receptionist+) SQL Injection CVSS 6.5 · 01.02.202617.03.20267.3KiviCare – Clinic & Patient Management System (EHR) <= 4.1.2 - Unauthenticated Authentication Bypass via Social Login Token CVSS 7.3 · 17.03.20268.2KiviCare <= 4.1.2 - Missing Authorization to Unauthenticated Privilege Escalation via Setup Wizard CVSS 8.2 · 17.03.202623.03.20266.1KiviCare – Clinic & Patient Management System (EHR) <= 3.6.16 - Reflected Cross-Site Scripting CVSS 6.1 · 23.03.20265.3KiviCare – Clinic & Patient Management System (EHR) <= 3.6.16 - Missing Authorization CVSS 5.3 · 23.03.202623.04.20264.3KiviCare – Clinic & Patient Management System (EHR) <= 4.2.1 - Authenticated (Subscriber+) Insecure Direct Object Reference CVSS 4.3 · 23.04.202626.05.20265.3KiviCare – Clinic & Patient Management System (EHR) <= 4.3.0 - Missing Authorization CVSS 5.3 · 26.05.202609.07.20265.3KiviCare <= 4.4.0 - Missing Authorization to Unauthenticated Payment Bypass and Appointment Status Manipulation via /payment-success REST Endpoint CVSS 5.3 · 09.07.202610.07.20266.5KiviCare <= 4.5.0 - Authenticated (Doctor+) SQL Injection via 'orderby' Parameter in DoctorSessionController CVSS 6.5 · 10.07.20266.5KiviCare <= 4.5.0 - Authenticated (Doctor+) SQL Injection via 'orderby' Parameter in KCQueryBuilder CVSS 6.5 · 10.07.202610.08.20266.5KiviCare <= 4.5.1 - Authenticated (Authenticated+) SQL Injection CVSS 6.5 · 10.08.202613.08.20264.3KiviCare – Clinic & Patient Management System (EHR) < 4.5.2 - Authenticated (Custom role+) Information Exposure CVSS 4.3 · 13.08.202614.08.20269.8KiviCare – Clinic & Patient Management System (EHR) < 4.5.2 - Unauthenticated Privilege Escalation CVSS 9.8 · 14.08.20266.5KiviCare <= 4.5.1 - Authenticated (Doctor+) SQL Injection via 'searchTerm' Parameter CVSS 6.5 · 14.08.202621.08.20264.3KiviCare – Clinic & Patient Management System (EHR) < 4.5.4 - Missing Authorization CVSS 4.3 · 21.08.20264.3KiviCare – Clinic & Patient Management System (EHR) < 4.5.4 - Missing Authorization CVSS 4.3 · 21.08.202628.08.20265.3KiviCare – Clinic & Patient Management System (EHR) <= 4.5.4 - Unauthenticated Information Exposure CVSS 5.3 · 28.08.2026

Strategic Overview

Avg CVSSMedium
6.2/ 10
Patch Coverage100%
Open

0

Fixed

29

Get automatic notifications for all KiviCare – Clinic & Patient Management System (EHR) vulnerabilities before they are exploited.

Highest severity on recordCVSS 9.8CVE-2026-13610

KiviCare – Clinic & Patient Management System (EHR) < 4.5.2 - Unauthenticated Privilege Escalation

Read the full analysis

Vulnerability Records

29 records
2026-08-28 00:00CVE-2026-13611
5.3
Medium
Sai Praneeth KotiYes
2026-08-21 00:00CVE-2026-19417
4.3
Medium
Erwan LRYes
2026-08-21 00:00CVE-2026-19416
4.3
Medium
Erwan LRYes
2026-08-14 15:14CVE-2026-15453
6.5
Medium
Wordfence PRISMYes
2026-08-14 00:00CVE-2026-13610
9.8
Critical
Sai Praneeth KotiYes
2026-08-13 00:00CVE-2026-13612
4.3
Medium
Sai Praneeth KotiYes
2026-08-10 00:00CVE-2026-13613
6.5
Medium
Mokksh ParekhYes
2026-07-10 14:03CVE-2026-15072
6.5
Medium
Wordfence PRISMYes
2026-07-10 14:02CVE-2026-15073
6.5
Medium
Wordfence PRISMYes
2026-07-09 20:52CVE-2026-11990
5.3
Medium
Niv KochanYes
Showing 1–10 of 29 reports
KiviCare – Clinic & Patient Management System (EHR) banner
Latestv4.5.5

KiviCare – Clinic & Patient Management System (EHR)

Iqonic Design

Author

Iqonic Design

3.6(23)
72/100
Last Updated
2026-08-22 (22d ago)
Active Installs
1,000+
Downloads
129,559
Requires WP
3.0.1+
Requires PHP
8.0+
Tested up to
WP 7.0.0
Created
2020-10-22 (6y ago)

🚀 Launch Your Complete Online Clinic in 60 Seconds! KiviCare is the most advanced, self-hosted clinic and patient management solution (EHR) built for WordPress. Powered by React 19 and Bootstrap 5, KiviCare delivers a lightning-fast, modern interface that doesn’t feel like a typical WordPress plugin. NEW in Version 4.0: Complete UI/UX Redesign! After 3+ years of development and refinement, KiviCare now features a completely redesigned modern interface with improved performance, cleaner design, and enhanced user experience. It’s the only Medical EHR solution on WordPress that provides a pure MAGICAL EXPERIENCE comparable to modern SaaS applications. DEMO | PRO | WP Theme | Zoom Telemed | Google Meet Telemed | Mobile App | Docs A WordPress plugin that doesn’t feel like one. What’s New in Version 4.0 (The Big Redesign!) Modern Interface & Performance Completely Redesigned UI – Built with React 19 + Bootstrap 5 for a premium, modern look Lightning-Fast Performance – Lazy loading components and optimized rendering Smoother Navigation – Cleaner design with improved user experience Language Switcher – Easily change preferred language from the header Enhanced Scheduling Day-Wise Time Slots – Set unique availability for each day of the week Flexible Doctor Scheduling – Different time slots for different days Better Appointment Management – Streamlined booking flow Payment Flexibility NEW: KnitPay Integration – Support for 500+ payment gateways worldwide PayPal Integration – Accept online payments seamlessly WooCommerce Compatible – Full e-commerce integration (Pro) Technical Improvements WordPress REST API – Modern, reliable API architecture Action Scheduler Integration – Stable background processing for queued tasks Customizable Print Templates – Easy branding through child themes HTML Email Templates – Rich, beautiful email notifications Core Features Complete Clinic Management Built with React 19 – Zero page reloads, instant responses Appointment Booking System – Smart scheduling with conflict prevention Patient Records Management – Comprehensive patient history Encounter (Patient Visits) Management – Track every patient interaction Doctor Scheduling – Flexible session management Doctor Services – Service catalog with pricing Multi-Role User System Complete role-based access control: – Super Admin – Full system control – Clinic Admin – Clinic-level management – Doctor – Patient care and scheduling – Receptionist – Front desk operations – Patient – Self-service portal Patient Portal Patient Self-Service Portal – Book, manage, and view appointments Medical History Access – Patients can view their records Appointment Reminders – Email notifications Website Integration Powerful widgets & blocks for your website: – Booking Form / Button – [kivicareBookAppointmentButton] – Doctor List Widget – Showcase your medical team – Login/Register Page – [kivicareRegisterLogin] – Clinic List – Display multiple locations Configuration & Customization Email Reminders & Notifications – Automated patient communication Custom Email Templates – Brand your communications Custom Fields – Extend forms with custom data Powerful Settings Panel – Comprehensive configuration options Multilanguage Support – Translation-ready Insightful Dashboard – Real-time clinic overview Pro Features – Unlock Enterprise Power View KiviCare Pro Transform your clinic into a multi-location healthcare empire: Multi-Clinic Enterprise Multi-Clinic Setup – Manage unlimited clinics from one dashboard Centralized Administration – Control all locations effortlessly Clinic-Specific Settings – Customize each location independently Advanced Payments & E-Commerce WooCommerce Integration – Full e-commerce payment processing Multiple Payment Gateways – Maximum payment flexibility Revenue Reports – Track income across all clinics Professional Scheduling Google Calendar Integration – Two-way sync with Google Calendar Calendar Sharing – Share availability with colleagues Appointment Conflicts – Automatic conflict prevention Advanced Communication SMS Alerts via Twilio – Automated SMS notifications WhatsApp Alerts – WhatsApp appointment reminders Custom Notifications – Design your own notification templates Multi-Channel Communication – Reach patients on their preferred platform Telemedicine Ready Zoom Integration (Addon) – Virtual consultations with video Google Meet Integration (Addon) – Secure virtual visits One-Click Join – Seamless telehealth experience Business Intelligence Advanced Reports – Comprehensive clinic analytics Performance Metrics – Track KPIs and growth Export Data – CSV/Excel exports for analysis Premium Customization Advanced Styling Options – Match your clinic branding RTL Support – Right-to-left language support White Label Ready – Remove KiviCare branding KiviCare Premium Products Build a complete digital healthcare ecosystem: KiviCare Pro – Enterprise clinic management KiviCare WordPress Theme – Professional clinic website Zoom Telemed Addon – Video consultations Google Meet Telemed Addon – Secure telemed solution Flutter Mobile App – iOS & Android apps Professional Services Need expert help with setup, migration, or customization? 👉 Get a Quote from Our Experts Support & Resources Complete Documentation – Step-by-step guides Video Tutorials – Visual learning resources Community Support – Active user community Submit Feature Requests We listen carefully! Have an idea to make KiviCare better? 👉 Submit Your Feature Request You Are In Good Company KiviCare is crafted by IQONIC Design – a team of expert, young, and dynamic creators of community-focused digital products. Trusted by over 100,000+ individuals and businesses worldwide. More FREE Products from IQONIC We love our community! Check out our other amazing free products: Graphina – The most powerful Elementor charts and graphs plugin MARVY – Coolest background animations for Elementor WP Roadmap – Create product roadmaps and feedback boards Connect With Us on Social Media Instagram YouTube Dribbble Facebook Twitter

Vulnerability data © Defiant, Inc., provided under the Wordfence Intelligence T&C