CVE-2026-13613 — KiviCare < 4.5.2 - Doctor/Receptionist+ SQL Injection via settings/listing REST Endpoint
The KiviCare WordPress plugin before 4.5.2 does not properly sanitise and escape user-supplied parameters before using them in a SQL query, allowing authenticated users with a …
Published: 2026-08-12 · CVSS: 8.8 · CVSS 3.1
The KiviCare WordPress plugin before 4.5.2 does not properly sanitise and escape user-supplied parameters before using them in a SQL query, allowing authenticated users with a clinic staff-level role to perform SQL injection.
Source: CVE Program · Revision 8b16575c39f1e1810c5e863010da073d2d3285e7