high8.8
CVE-2026-13613
The KiviCare WordPress plugin before 4.5.2 does not properly sanitise and escape user-supplied parameters before using them in a SQL query, allowing authentica…
Impact
The KiviCare WordPress plugin before 4.5.2 does not properly sanitise and escape user-supplied parameters before using them in a SQL query, allowing authenticated users with a clinic staff-level role to perform SQL injection.
Affected products
| Product | Affected versions |
|---|---|
| KiviCare WordPress Plugin | before 4.5.2 |
Versions were read from the advisory text. No structured product data has been published for this record yet.