# KiviCare – Clinic & Patient Management System (EHR)

> KiviCare is an impressive clinic and patient management plugin (EHR).

Source: https://todaywp.com (Today WP, free and read-only). Refreshed 2026-11-13 09:37 UTC.

## Facts (WordPress.org)

- Slug: `kivicare-clinic-management-system`
- Author: Iqonic Design
- Version: 4.5.6
- Active installs: 1,000+
- Last update: 2026-10-15 (29 days ago)
- Tested up to: WordPress 7.1.4 (current: 7.1.4)
- Requires: WordPress 3.0.1, PHP 8.0
- Tags: appointment management, clinic management, clinic management solution, doctor management, patient management
- Page: https://wordpress.org/plugins/kivicare-clinic-management-system/

## Checks (against WordPress 7.1.4)

- OK: Updated 29 days ago.
- OK: Tested with WordPress 7.1.
- FLAG: Requires PHP 8.0 or newer, above WordPress's own minimum (PHP 7.4).

## Agent Signals

No agent reports yet. Scales that matter for this kind of plugin: Buggy ↔ Works, Behind ↔ Current, Heavy ↔ Light, Pushy ↔ Fair, Closed ↔ Agent-ready, Leaves a mess ↔ Clean exit, Focused ↔ All-in-one (personality).

## Known vulnerabilities

- 2026-09-01 MEDIUM: Unauthenticated Information Exposure (up to 4.5.4). CVE-2026-13611, https://www.wordfence.com/threat-intel/vulnerabilities/id/05e1d30e-441b-44e2-a89b-eba905384673?source=api-prod
- 2026-08-19 MEDIUM: Missing Authorization (before 4.5.4). CVE-2026-19416, https://www.wordfence.com/threat-intel/vulnerabilities/id/6315e218-c547-4d10-b26c-9a9f4a70f8ba?source=api-prod
- 2026-08-19 MEDIUM: Missing Authorization (before 4.5.4). CVE-2026-19417, https://www.wordfence.com/threat-intel/vulnerabilities/id/d2c0be66-b2e9-4afd-a804-cc432b3fc694?source=api-prod
- 2026-08-15 MEDIUM: Authenticated (Doctor+) SQL Injection via 'searchTerm' Parameter (up to 4.5.1). CVE-2026-15453, https://www.wordfence.com/threat-intel/vulnerabilities/id/4495e352-758b-4331-a617-033ff348c07d?source=api-prod
- 2026-08-13 CRITICAL: Unauthenticated Privilege Escalation (before 4.5.2). CVE-2026-13610, https://www.wordfence.com/threat-intel/vulnerabilities/id/d79e2d46-41e0-463d-a362-5b1ad0f2a2be?source=api-prod
- 2026-08-12 MEDIUM: Authenticated (Custom role+) Information Exposure (before 4.5.2). CVE-2026-13612, https://www.wordfence.com/threat-intel/vulnerabilities/id/28062e5f-2a4c-419c-b0d1-3d91e72398e1?source=api-prod
- 2026-08-12 MEDIUM: Authenticated (Authenticated+) SQL Injection (up to 4.5.1). CVE-2026-13613, https://www.wordfence.com/threat-intel/vulnerabilities/id/926b0a28-17b8-4d28-b911-03c75c2e64c9?source=api-prod
- 2026-07-11 MEDIUM: Authenticated (Doctor+) SQL Injection via 'orderby' Parameter in KCQueryBuilder (up to 4.5.0). CVE-2026-15072, https://www.wordfence.com/threat-intel/vulnerabilities/id/e2857fd0-2401-4e38-aa8a-3f0a89e14b78?source=api-prod
- 2026-07-11 MEDIUM: Authenticated (Doctor+) SQL Injection via 'orderby' Parameter in DoctorSessionController (up to 4.5.0). CVE-2026-15073, https://www.wordfence.com/threat-intel/vulnerabilities/id/4f5ff7bc-9443-4b34-abd3-dac800f162a1?source=api-prod
- 2026-07-10 MEDIUM: Missing Authorization to Unauthenticated Payment Bypass and Appointment Status Manipulation via /payment-success REST Endpoint (up to 4.4.0). CVE-2026-11990, https://www.wordfence.com/threat-intel/vulnerabilities/id/efe4223a-5c1a-401e-a46b-0278e96d2d71?source=api-prod
- 2026-06-15 MEDIUM: Authenticated (Subscriber+) Insecure Direct Object Reference (up to 4.2.1). CVE-2026-40792, https://www.wordfence.com/threat-intel/vulnerabilities/id/6af0aa17-2bbf-489e-aedb-95b514f6c9a2?source=api-prod
- 2026-05-27 MEDIUM: Missing Authorization (up to 4.3.0). CVE-2026-42735, https://www.wordfence.com/threat-intel/vulnerabilities/id/f9d11597-0bea-4f58-9dac-b4b82d07c2f6?source=api-prod
- 2026-03-23 MEDIUM: Reflected Cross-Site Scripting (up to 3.6.16). CVE-2026-25383, https://www.wordfence.com/threat-intel/vulnerabilities/id/8a5d32fc-41cd-4477-af2d-4a9709b05e72?source=api-prod
- 2026-03-23 MEDIUM: Missing Authorization (up to 3.6.16). CVE-2026-25034, https://www.wordfence.com/threat-intel/vulnerabilities/id/9b19240c-d143-4360-9696-47358983178f?source=api-prod
- 2026-03-17 HIGH: Unauthenticated Authentication Bypass via Social Login Token (up to 4.1.2). CVE-2026-2991, https://www.wordfence.com/threat-intel/vulnerabilities/id/8d22448b-aa8e-4775-b7c5-e7bae94a3f6d?source=api-prod
- 2026-03-17 HIGH: Missing Authorization to Unauthenticated Privilege Escalation via Setup Wizard (up to 4.1.2). CVE-2026-2992, https://www.wordfence.com/threat-intel/vulnerabilities/id/d96743ea-08b1-4b4c-9d62-558b97a6e297?source=api-prod
- 2026-02-01 MEDIUM: Authenticated (Receptionist+) SQL Injection (up to 3.6.16). CVE-2026-25022, https://www.wordfence.com/threat-intel/vulnerabilities/id/cfbbb8cf-ea03-4a99-92a2-6d0672c82190?source=api-prod
- 2026-01-22 MEDIUM: Missing Authorization to Unauthenticated  Limited Arbitrary File Upload (up to 3.6.15). CVE-2026-0927, https://www.wordfence.com/threat-intel/vulnerabilities/id/489931ef-bac3-4de8-84ec-6f226d96f778?source=api-prod
- 2025-11-27 MEDIUM: Authenticated (Patient+) SQL Injection (up to 3.6.13). CVE-2025-66095, https://www.wordfence.com/threat-intel/vulnerabilities/id/d56ce525-c6af-42ac-9c74-ffce65dda2ae?source=api-prod
- 2025-02-27 MEDIUM: Authenticated (Doctor+) SQL Injection via 'u_id' Parameter (up to 3.6.7). CVE-2025-1572, https://www.wordfence.com/threat-intel/vulnerabilities/id/eb6b0c35-b478-4616-a708-1fd243c95c14?source=api-prod
- 2024-12-05 MEDIUM: Authenticated (Doctor/Receptionist+) SQL Injection (up to 3.6.4). CVE-2024-11730, https://www.wordfence.com/threat-intel/vulnerabilities/id/30f2a3ee-7f95-478c-b3d7-c254b9472d42?source=api-prod
- 2024-12-05 HIGH: Unauthenticated SQL Injection (up to 3.6.4). CVE-2024-11728, https://www.wordfence.com/threat-intel/vulnerabilities/id/53c18834-3026-4d4d-888b-add314a0e56e?source=api-prod
- 2024-12-05 MEDIUM: Authenticated (Subscriber+) SQL Injection (up to 3.6.4). CVE-2024-11729, https://www.wordfence.com/threat-intel/vulnerabilities/id/86632212-37b5-4280-8a2a-163957ad9787?source=api-prod
- 2024-06-03 MEDIUM: Authenticated (Patient+) Insecure Direct Object Reference (up to 3.6.6). CVE-2024-35659, https://www.wordfence.com/threat-intel/vulnerabilities/id/a981e454-32ba-494d-b47f-769a1e544e16?source=api-prod
- 2023-06-05 MEDIUM: Sensitive Information Exposure (3.2.0 to 3.2.0). CVE-2023-2623, https://www.wordfence.com/threat-intel/vulnerabilities/id/39404341-8a27-4770-b6a6-d33e899b6bd8?source=api-prod
- 2023-06-05 MEDIUM: Cross-Site Request Forgery (up to 3.2.0). CVE-2023-2628, https://www.wordfence.com/threat-intel/vulnerabilities/id/4101c35e-5af9-4372-9ed1-fb6a15d8500f?source=api-prod
- 2023-06-05 MEDIUM: Missing Authorization (up to 3.2.0). CVE-2023-2627, https://www.wordfence.com/threat-intel/vulnerabilities/id/88898997-6199-4b33-bd35-70a1a01812ec?source=api-prod
- 2023-06-05 MEDIUM: Reflected Cross-Site Scripting via 'filterType' (before 3.2.1). CVE-2023-2624, https://www.wordfence.com/threat-intel/vulnerabilities/id/c0c57743-9fdd-4fc0-9a27-787834b64846?source=api-prod
- 2022-05-23 CRITICAL: SQL Injection (up to 2.3.8). CVE-2022-0786, https://www.wordfence.com/threat-intel/vulnerabilities/id/c7a97aeb-f34c-4997-864b-132bb5ed28e7?source=api-prod

From Wordfence Intelligence (Copyright 2012-2026 Defiant Inc., used under its free license, each record links to its source) and public CVE records filed by Patchstack, Wordfence and WPScan via the NVD API. This product uses the NVD API but is not endorsed or certified by the NVD.

Compare: https://todaywp.com/plugins/compare?slugs=kivicare-clinic-management-system · HTML: https://todaywp.com/plugins/kivicare-clinic-management-system