What is the CVSS score of CVE-2026-25383?

CVE-2026-25383 has a CVSS 3.1 base score of 7.1 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L. EPSS exploitation probability: 0.0%.

Which versions of Kivicare are affected by CVE-2026-25383?

CVE-2026-25383 presents moderate security risk, a cross-site scripting vulnerability rated CVSS 7.1.

How to fix or mitigate CVE-2026-25383?

Within 7 days: Identify all affected systems and apply vendor patches promptly. Verify anti-CSRF tokens and content security policies are enforced.

Kivicare CVE-2026-25383

EUVD-2026-15703 HIGH

Cross-site Scripting (XSS) (CWE-79)

2026-03-25 Patchstack

GHSA-qwjr-hq3m-j5xf

XSS Kivicare

7.1

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

7.1 HIGH

AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Changed

Confidentiality

Low

Integrity

Low

Availability

Low

Lifecycle Timeline

Re-analysis Queued

Apr 24, 2026 - 16:37 vuln.today

cvss_changed

EUVD ID Assigned

Mar 25, 2026 - 16:47 euvd

EUVD-2026-15703

Analysis Generated

Mar 25, 2026 - 16:47 vuln.today

CVE Published

Mar 25, 2026 - 16:14 nvd

HIGH 7.1

DescriptionCVE.org

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Iqonic Design KiviCare kivicare-clinic-management-system allows Reflected XSS.This issue affects KiviCare: from n/a through <= 3.6.16.

AnalysisAI

A Reflected Cross-Site Scripting (XSS) vulnerability exists in Iqonic Design's KiviCare clinic management system through version 3.6.16, allowing attackers to inject malicious scripts into web pages viewed by users. An attacker can craft a malicious URL containing JavaScript payload and trick users into clicking it, enabling session hijacking, credential theft, or unauthorized actions within the clinic management system. No CVSS score, EPSS probability, or KEV status are available, though the vulnerability was publicly disclosed by Patchstack and is categorized under CWE-79 (Improper Neutralization of Input During Web Page Generation).

Technical ContextAI

The vulnerability is a Reflected XSS flaw classified under CWE-79, which occurs when user-supplied input is improperly sanitized before being rendered in HTML responses. KiviCare, identified via CPE cpe:2.3:a:iqonic_design:kivicare:*:*:*:*:*:*:*:*, is a WordPress-based clinic management plugin that fails to adequately neutralize malicious input parameters during web page generation. This allows attackers to bypass input validation and output encoding mechanisms, enabling arbitrary JavaScript execution in the victim's browser within the context of the vulnerable application's origin.

RemediationAI

Immediately upgrade KiviCare to a version newer than 3.6.16 once available from Iqonic Design, or contact the vendor at https://patchstack.com/ for patch availability and timeline information. Until an official patch is released, implement defense-in-depth controls: enforce strict Content Security Policy (CSP) headers to prevent inline script execution, enable HTTP-only and Secure flags on session cookies, and deploy a Web Application Firewall (WAF) with rules to detect and block XSS payloads in query parameters and form inputs. Additionally, restrict administrative access to KiviCare installations to trusted IP ranges and educate users not to click on untrusted links referencing the clinic management system.