KiviCare – Clinic & Patient Management System (EHR)

Explore KiviCare – Clinic & Patient Management System (EHR) vulnerabilities across all versions. Currently tracking 22 known vulnerabilities, including severity, impact, and patch status.

01234567891022.10.2020Today23.05.20229.8KiviCare – Clinic & Patient Management System (EHR) <= 2.3.8 - SQL Injection CVSS 9.8 · 23.05.202205.06.20235.4KiviCare – Clinic & Patient Management System (EHR) <= 3.2.0 - Missing Authorization CVSS 5.4 · 05.06.20236.1KiviCare <= 3.2.0 - Reflected Cross-Site Scripting via 'filterType' CVSS 6.1 · 05.06.20236.5KiviCare – Clinic & Patient Management System (EHR) <= 3.2.0 - Cross-Site Request Forgery CVSS 6.5 · 05.06.20236.5KiviCare – Clinic & Patient Management System (EHR) <= 3.2.0 - Sensitive Information Exposure CVSS 6.5 · 05.06.202303.06.20244.3KiviCare <= 3.6.6 - Authenticated (Patient+) Insecure Direct Object Reference CVSS 4.3 · 03.06.202405.12.20246.5KiviCare – Clinic & Patient Management System (EHR) <= 3.6.4 - Authenticated (Subscriber+) SQL Injection CVSS 6.5 · 05.12.20247.5KiviCare – Clinic & Patient Management System (EHR) <= 3.6.4 - Unauthenticated SQL Injection CVSS 7.5 · 05.12.20246.5KiviCare – Clinic & Patient Management System (EHR) <= 3.6.4 - Authenticated (Doctor/Receptionist+) SQL Injection CVSS 6.5 · 05.12.202427.02.20256.5KiviCare – Clinic & Patient Management System (EHR) <= 3.6.7 - Authenticated (Doctor+) SQL Injection via 'u_id' Parameter CVSS 6.5 · 27.02.202527.11.20256.5KiviCare <= 3.6.13 - Authenticated (Patient+) SQL Injection CVSS 6.5 · 27.11.202522.01.20265.3KiviCare – Clinic & Patient Management System (EHR) <= 3.6.15 - Missing Authorization to Unauthenticated Limited Arbitrary File Upload CVSS 5.3 · 22.01.202601.02.20266.5KiviCare <= 3.6.16 - Authenticated (Receptionist+) SQL Injection CVSS 6.5 · 01.02.202617.03.20267.3KiviCare – Clinic & Patient Management System (EHR) <= 4.1.2 - Unauthenticated Authentication Bypass via Social Login Token CVSS 7.3 · 17.03.20268.2KiviCare <= 4.1.2 - Missing Authorization to Unauthenticated Privilege Escalation via Setup Wizard CVSS 8.2 · 17.03.202623.03.20265.3KiviCare – Clinic & Patient Management System (EHR) <= 3.6.16 - Missing Authorization CVSS 5.3 · 23.03.20266.1KiviCare – Clinic & Patient Management System (EHR) <= 3.6.16 - Reflected Cross-Site Scripting CVSS 6.1 · 23.03.202623.04.20264.3KiviCare – Clinic & Patient Management System (EHR) <= 4.2.1 - Authenticated (Subscriber+) Insecure Direct Object Reference CVSS 4.3 · 23.04.202626.05.20265.3KiviCare – Clinic & Patient Management System (EHR) <= 4.3.0 - Missing Authorization CVSS 5.3 · 26.05.202609.07.20265.3KiviCare <= 4.4.0 - Missing Authorization to Unauthenticated Payment Bypass and Appointment Status Manipulation via /payment-success REST Endpoint CVSS 5.3 · 09.07.202610.07.20266.5KiviCare <= 4.5.0 - Authenticated (Doctor+) SQL Injection via 'orderby' Parameter in DoctorSessionController CVSS 6.5 · 10.07.20266.5KiviCare <= 4.5.0 - Authenticated (Doctor+) SQL Injection via 'orderby' Parameter in KCQueryBuilder CVSS 6.5 · 10.07.2026

Strategic Overview

Avg CVSSMedium
6.3/ 10
Patch Coverage100%
Open

0

Fixed

22

Get automatic notifications for all KiviCare – Clinic & Patient Management System (EHR) vulnerabilities before they are exploited.

Vulnerability Records

22 records
2026-07-10 14:03CVE-2026-15072
6.5
Medium
Wordfence PRISMYes
2026-07-10 14:02CVE-2026-15073
6.5
Medium
Wordfence PRISMYes
2026-07-09 20:52CVE-2026-11990
5.3
Medium
Niv KochanYes
2026-05-26 00:00CVE-2026-42735
5.3
Medium
kai63001Yes
2026-04-23 00:00CVE-2026-40792
4.3
Medium
Jakub HermanYes
2026-03-23 00:00CVE-2026-25034
5.3
Medium
andrea bocchettiYes
2026-03-23 00:00CVE-2026-25383
6.1
Medium
johskaYes
2026-03-17 00:00CVE-2026-2991
7.3
High
Gibran AbdillahYes
2026-03-17 00:00CVE-2026-2992
8.2
High
Athiwat Tiprasaharn (Jitlada)Yes
2026-02-01 18:08CVE-2026-25022
6.5
Medium
alakinnnYes
Showing 1–10 of 22 reports
KiviCare &#8211; Clinic &amp; Patient Management System (EHR) banner
Latestv4.5.1

KiviCare &#8211; Clinic &amp; Patient Management System (EHR)

Iqonic Design

Author

Iqonic Design

3.6(23)
72/100
Last Updated
2026-07-10 (20d ago)
Active Installs
2,000+
Downloads
124,596
Requires WP
3.0.1+
Requires PHP
8.0+
Tested up to
WP 7.0.0
Created
2020-10-22 (6y ago)

🚀 Launch Your Complete Online Clinic in 60 Seconds! KiviCare is the most advanced, self-hosted clinic and patient management solution (EHR) built for WordPress. Powered by React 19 and Bootstrap 5, KiviCare delivers a lightning-fast, modern interface that doesn’t feel like a typical WordPress plugin. NEW in Version 4.0: Complete UI/UX Redesign! After 3+ years of development and refinement, KiviCare now features a completely redesigned modern interface with improved performance, cleaner design, and enhanced user experience. It’s the only Medical EHR solution on WordPress that provides a pure MAGICAL EXPERIENCE comparable to modern SaaS applications. DEMO | PRO | WP Theme | Zoom Telemed | Google Meet Telemed | Mobile App | Docs A WordPress plugin that doesn’t feel like one. What’s New in Version 4.0 (The Big Redesign!) Modern Interface & Performance Completely Redesigned UI – Built with React 19 + Bootstrap 5 for a premium, modern look Lightning-Fast Performance – Lazy loading components and optimized rendering Smoother Navigation – Cleaner design with improved user experience Language Switcher – Easily change preferred language from the header Enhanced Scheduling Day-Wise Time Slots – Set unique availability for each day of the week Flexible Doctor Scheduling – Different time slots for different days Better Appointment Management – Streamlined booking flow Payment Flexibility NEW: KnitPay Integration – Support for 500+ payment gateways worldwide PayPal Integration – Accept online payments seamlessly WooCommerce Compatible – Full e-commerce integration (Pro) Technical Improvements WordPress REST API – Modern, reliable API architecture Action Scheduler Integration – Stable background processing for queued tasks Customizable Print Templates – Easy branding through child themes HTML Email Templates – Rich, beautiful email notifications Core Features Complete Clinic Management Built with React 19 – Zero page reloads, instant responses Appointment Booking System – Smart scheduling with conflict prevention Patient Records Management – Comprehensive patient history Encounter (Patient Visits) Management – Track every patient interaction Doctor Scheduling – Flexible session management Doctor Services – Service catalog with pricing Multi-Role User System Complete role-based access control: – Super Admin – Full system control – Clinic Admin – Clinic-level management – Doctor – Patient care and scheduling – Receptionist – Front desk operations – Patient – Self-service portal Patient Portal Patient Self-Service Portal – Book, manage, and view appointments Medical History Access – Patients can view their records Appointment Reminders – Email notifications Website Integration Powerful widgets & blocks for your website: – Booking Form / Button – [kivicareBookAppointmentButton] – Doctor List Widget – Showcase your medical team – Login/Register Page – [kivicareRegisterLogin] – Clinic List – Display multiple locations Configuration & Customization Email Reminders & Notifications – Automated patient communication Custom Email Templates – Brand your communications Custom Fields – Extend forms with custom data Powerful Settings Panel – Comprehensive configuration options Multilanguage Support – Translation-ready Insightful Dashboard – Real-time clinic overview Pro Features – Unlock Enterprise Power View KiviCare Pro Transform your clinic into a multi-location healthcare empire: Multi-Clinic Enterprise Multi-Clinic Setup – Manage unlimited clinics from one dashboard Centralized Administration – Control all locations effortlessly Clinic-Specific Settings – Customize each location independently Advanced Payments & E-Commerce WooCommerce Integration – Full e-commerce payment processing Multiple Payment Gateways – Maximum payment flexibility Revenue Reports – Track income across all clinics Professional Scheduling Google Calendar Integration – Two-way sync with Google Calendar Calendar Sharing – Share availability with colleagues Appointment Conflicts – Automatic conflict prevention Advanced Communication SMS Alerts via Twilio – Automated SMS notifications WhatsApp Alerts – WhatsApp appointment reminders Custom Notifications – Design your own notification templates Multi-Channel Communication – Reach patients on their preferred platform Telemedicine Ready Zoom Integration (Addon) – Virtual consultations with video Google Meet Integration (Addon) – Secure virtual visits One-Click Join – Seamless telehealth experience Business Intelligence Advanced Reports – Comprehensive clinic analytics Performance Metrics – Track KPIs and growth Export Data – CSV/Excel exports for analysis Premium Customization Advanced Styling Options – Match your clinic branding RTL Support – Right-to-left language support White Label Ready – Remove KiviCare branding KiviCare Premium Products Build a complete digital healthcare ecosystem: KiviCare Pro – Enterprise clinic management KiviCare WordPress Theme – Professional clinic website Zoom Telemed Addon – Video consultations Google Meet Telemed Addon – Secure telemed solution Flutter Mobile App – iOS & Android apps Professional Services Need expert help with setup, migration, or customization? 👉 Get a Quote from Our Experts Support & Resources Complete Documentation – Step-by-step guides Video Tutorials – Visual learning resources Community Support – Active user community Submit Feature Requests We listen carefully! Have an idea to make KiviCare better? 👉 Submit Your Feature Request You Are In Good Company KiviCare is crafted by IQONIC Design – a team of expert, young, and dynamic creators of community-focused digital products. Trusted by over 100,000+ individuals and businesses worldwide. More FREE Products from IQONIC We love our community! Check out our other amazing free products: Graphina – The most powerful Elementor charts and graphs plugin MARVY – Coolest background animations for Elementor WP Roadmap – Create product roadmaps and feedback boards Connect With Us on Social Media Instagram YouTube Dribbble Facebook Twitter

Vulnerability data © Defiant, Inc., provided under the Wordfence Intelligence T&C