Iqonic Design
Monthly
Unauthenticated sensitive data exposure in KiviCare WordPress plugin versions 4.5.1 and below allows remote, unauthenticated attackers to access protected clinic and patient data through an authentication bypass (CWE-288). The CVSS 3.1 vector confirms network-level, zero-complexity, credential-free exploitation with high confidentiality impact and no integrity or availability dimension. No public exploit has been identified at time of analysis and the vulnerability is not listed in CISA KEV, but the attack profile is inherently accessible to any opportunistic actor who can reach the WordPress installation.
A Reflected Cross-Site Scripting (XSS) vulnerability exists in Iqonic Design's KiviCare clinic management system through version 3.6.16, allowing attackers to inject malicious scripts into web pages viewed by users. An attacker can craft a malicious URL containing JavaScript payload and trick users into clicking it, enabling session hijacking, credential theft, or unauthorized actions within the clinic management system. No CVSS score, EPSS probability, or KEV status are available, though the vulnerability was publicly disclosed by Patchstack and is categorized under CWE-79 (Improper Neutralization of Input During Web Page Generation).
Broken Access Control in the Graphina Elementor Charts and Graphs WordPress plugin (versions up to and including 3.1.12) allows unauthenticated remote attackers to access restricted functionality or data without proper authorization. The flaw stems from missing authorization checks (CWE-862), meaning certain plugin endpoints or AJAX actions fail to verify whether the requesting user holds the necessary permissions before serving a response. Impact is limited to partial confidentiality loss with no integrity or availability consequence. No public exploit code or active exploitation has been identified at time of analysis.
Insecure Direct Object References (IDOR) in the KiviCare WordPress clinic management plugin through version 4.2.1 allows any authenticated subscriber to bypass object-level authorization and access or modify records belonging to other users. Because WordPress subscriber is the default role for self-registered users, this effectively exposes sensitive healthcare data - including patient records, appointments, and prescriptions - to any registered site user who can enumerate or guess object identifiers. No public exploit has been identified at time of analysis, and this vulnerability has not been listed in the CISA KEV catalog.
Iqonic Design KiviCare clinic management system versions 3.6.16 and earlier contain an authorization bypass vulnerability that allows unauthenticated remote attackers to modify data and disrupt service availability through improperly configured access controls. The vulnerability has no available patch and affects the system's ability to properly enforce permission levels across its features.
Unauthenticated sensitive data exposure in KiviCare WordPress plugin versions 4.5.1 and below allows remote, unauthenticated attackers to access protected clinic and patient data through an authentication bypass (CWE-288). The CVSS 3.1 vector confirms network-level, zero-complexity, credential-free exploitation with high confidentiality impact and no integrity or availability dimension. No public exploit has been identified at time of analysis and the vulnerability is not listed in CISA KEV, but the attack profile is inherently accessible to any opportunistic actor who can reach the WordPress installation.
A Reflected Cross-Site Scripting (XSS) vulnerability exists in Iqonic Design's KiviCare clinic management system through version 3.6.16, allowing attackers to inject malicious scripts into web pages viewed by users. An attacker can craft a malicious URL containing JavaScript payload and trick users into clicking it, enabling session hijacking, credential theft, or unauthorized actions within the clinic management system. No CVSS score, EPSS probability, or KEV status are available, though the vulnerability was publicly disclosed by Patchstack and is categorized under CWE-79 (Improper Neutralization of Input During Web Page Generation).
Broken Access Control in the Graphina Elementor Charts and Graphs WordPress plugin (versions up to and including 3.1.12) allows unauthenticated remote attackers to access restricted functionality or data without proper authorization. The flaw stems from missing authorization checks (CWE-862), meaning certain plugin endpoints or AJAX actions fail to verify whether the requesting user holds the necessary permissions before serving a response. Impact is limited to partial confidentiality loss with no integrity or availability consequence. No public exploit code or active exploitation has been identified at time of analysis.
Insecure Direct Object References (IDOR) in the KiviCare WordPress clinic management plugin through version 4.2.1 allows any authenticated subscriber to bypass object-level authorization and access or modify records belonging to other users. Because WordPress subscriber is the default role for self-registered users, this effectively exposes sensitive healthcare data - including patient records, appointments, and prescriptions - to any registered site user who can enumerate or guess object identifiers. No public exploit has been identified at time of analysis, and this vulnerability has not been listed in the CISA KEV catalog.
Iqonic Design KiviCare clinic management system versions 3.6.16 and earlier contain an authorization bypass vulnerability that allows unauthenticated remote attackers to modify data and disrupt service availability through improperly configured access controls. The vulnerability has no available patch and affects the system's ability to properly enforce permission levels across its features.