CVE-2025-6058 | Critical | 9.8 | 2025-07-12 | The WPBookit plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the image_upload_handle() function hooked via… |
CVE-2025-6057 | High | 8.8 | 2025-07-12 | The WPBookit plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the handle_image_upload() function in all vers… |
CVE-2025-3811 | Critical | 9.8 | 2025-05-09 | The WPBookit plugin for WordPress is vulnerable to privilege escalation via account takeover in all versions up to, and including, 1.0.2. This is due to the pl… |
CVE-2025-3810 | Critical | 9.8 | 2025-05-09 | The WPBookit plugin for WordPress is vulnerable to privilege escalation via account takeover in all versions up to, and including, 1.0.2. This is due to the pl… |
CVE-2025-32254 | Medium | 5.3 | 2025-04-04 | Missing Authorization vulnerability in Iqonic Design WPBookit wpbookit allows Accessing Functionality Not Properly Constrained by ACLs.This issue affects WPBoo… |
CVE-2025-26910 | High | 7.1 | 2025-03-10 | Cross-Site Request Forgery (CSRF) vulnerability in Iqonic Design WPBookit wpbookit allows Stored XSS.This issue affects WPBookit: from n/a through <= 1.0.1. |
CVE-2025-1572 | Medium | 6.5 | 2025-02-28 | The KiviCare – Clinic & Patient Management System (EHR) plugin for WordPress is vulnerable to SQL Injection via the ‘u_id’ parameter in all versions up to, and… |
CVE-2025-0357 | Critical | 9.8 | 2025-01-25 | The WPBookit plugin for WordPress is vulnerable to arbitrary file uploads due to insufficient file type validation in the 'WPB_Profile_controller::handle_image… |
CVE-2024-10215 | Critical | 9.8 | 2025-01-09 | The WPBookit plugin for WordPress is vulnerable to Arbitrary User Password Change in versions up to, and including, 1.6.4. This is due to the plugin providing… |
CVE-2024-54280 | Critical | 9.3 | 2024-12-16 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Iqonic Design WPBookit wpbookit allows SQL Injection.This… |
CVE-2024-11730 | Medium | 6.5 | 2024-12-06 | The KiviCare – Clinic & Patient Management System (EHR) plugin for WordPress is vulnerable to SQL Injection via the 'sort[]' parameter of the static_data_list… |
CVE-2024-11729 | Medium | 6.5 | 2024-12-06 | The KiviCare – Clinic & Patient Management System (EHR) plugin for WordPress is vulnerable to SQL Injection via the 'service_list[0][service_id]' parameter of… |
CVE-2024-11728 | High | 7.5 | 2024-12-06 | The KiviCare – Clinic & Patient Management System (EHR) plugin for WordPress is vulnerable to SQL Injection via the 'visit_type[service_id]' parameter of the t… |
CVE-2024-35659 | Medium | 5.3 | 2024-06-08 | Missing Authorization vulnerability in Iqonic Design KiviCare kivicare-clinic-management-system allows Exploiting Incorrectly Configured Access Control Securit… |
CVE-2023-41128 | Medium | 5.9 | 2023-11-30 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Iqonic Design WP Roadmap – Product Feedback Board allows… |
CVE-2023-2628 | High | 8.8 | 2023-06-27 | The KiviCare WordPress plugin before 3.2.1 does not have CSRF checks (either flawed or missing completely) in various AJAX actions, which could allow attackers… |
CVE-2023-2627 | Medium | 4.3 | 2023-06-27 | The KiviCare WordPress plugin before 3.2.1 does not have proper CSRF and authorisation checks in various AJAX actions, allowing any authenticated users, such a… |
CVE-2023-2624 | Medium | 6.1 | 2023-06-27 | The KiviCare WordPress plugin before 3.2.1 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Sc… |
CVE-2023-2623 | Medium | 6.5 | 2023-06-27 | The KiviCare WordPress plugin before 3.2.1 does not restrict the information returned in a response and returns all user data, allowing low privilege users suc… |
CVE-2022-0786 | Critical | 9.8 | 2022-06-13 | The KiviCare WordPress plugin before 2.3.9 does not sanitise and escape some parameters before using them in SQL statements via the ajax_post AJAX action with… |