Unknown Kivicare vulnerabilities

6 CVEs affecting Unknown Kivicare, 0 known to be exploited (CISA KEV), with EPSS scores. Latest: CVE-2026-13611, published 2026-09-01.

Highest priority

Known exploited (CISA KEV) first, then by EPSS exploit probability.

CVE-2026-13613, published 2026-08-12. High severity, CVSS 8.8. EPSS: 0.4% chance of exploitation in the next 30 days. The KiviCare WordPress plugin before 4.5.2 does not properly sanitise and escape user-supplied parameters before using them in a SQL query, allowing authenticated users with a clinic staff-level…
CVE-2026-13610, published 2026-08-13. High severity, CVSS 7.5. EPSS: 0.4% chance of exploitation in the next 30 days. The KiviCare WordPress plugin before 4.5.2 does not restrict the roles assignable through its unauthenticated registration endpoint, allowing unauthenticated attackers to create an active,…
CVE-2026-19417, published 2026-08-19. Medium severity, CVSS 6.5. EPSS: 0.3% chance of exploitation in the next 30 days. The KiviCare WordPress plugin before 4.5.4 does not verify that the requesting user is entitled to the media file being served, allowing authenticated patient-level users to download any file in the…
CVE-2026-19416, published 2026-08-19. Medium severity, CVSS 4.3. EPSS: 0.3% chance of exploitation in the next 30 days. The KiviCare WordPress plugin before 4.5.4 does not verify that the requesting user owns the appointment being modified, allowing authenticated patient-level users to cancel and reschedule other…
CVE-2026-13612, published 2026-08-12. Medium severity, CVSS 4.3. EPSS: 0.3% chance of exploitation in the next 30 days. The KiviCare WordPress plugin before 4.5.2 does not verify that the requesting user owns the records being accessed, allowing authenticated patient-level users to read other patients' bills,…
CVE-2026-13611, published 2026-09-01. Medium severity, CVSS 5.3. EPSS: 0.2% chance of exploitation in the next 30 days. The KiviCare WordPress plugin before 4.5.5 does not perform authorization checks on some of its REST endpoints, allowing unauthenticated attackers to disclose the patient roster and, when a payment…