WordPress Plugin Vulnerabilities

Slug
Published
Title
Slug
kirki
Published
2026-10-09
Title
Kirki < 6.3.2 - Editor+ Blind SSRF via Remote Template URL
Slug
kirki
Published
2026-10-09
Title
Kirki < 6.3.2 - Unauthenticated Arbitrary Shortcode Execution via Comments Collection
Slug
kirki
Published
2026-10-09
Title
Kirki < 6.3.2 - Subscriber+ Arbitrary Shortcode Execution via 'display_name'
Slug
kirki
Published
2026-10-16
Title
Kirki < 6.4.0 - Unauthenticated Sensitive User Data Disclosure via 'context' Parameter
Slug
kirki
Published
2026-10-16
Title
Kirki < 6.4.0 - Editor+ PHP Object Injection via ZIP Template Import
Slug
kirki
Published
2026-10-26
Title
Kirki < 6.3.0 - Subscriber+ PHP Object Injection via 'get-single-symbol' AJAX Endpoint
Slug
kish-guest-posting
Published
2014-08-01
Title
Kish Guest Posting 1.2 - Arbitrary File Upload
Slug
kitestudio-core
Published
2022-06-15
Title
Core Plugin for Kitestudio Themes < 2.3.1 - Reflected Cross-Site-Scripting
Slug
kittycatfish
Published
2026-06-09
Title
KittyCatfish <= 2.2 - Unauthenticated SQL Injection
Slug
kivicare-clinic-management-system
Published
2022-05-23
Title
KiviCare < 2.3.9 - Unauthenticated SQLi
Slug
kivicare-clinic-management-system
Published
2023-06-05
Title
KiviCare Management System < 3.2.1 - Reflected Cross-Site Scripting
Slug
kivicare-clinic-management-system
Published
2023-06-05
Title
KiviCare Management System < 3.2.1 - Multiple CSRF
Slug
kivicare-clinic-management-system
Published
2023-06-05
Title
KiviCare Management System < 3.2.1 - Subscriber+ Unauthorised AJAX Calls
Slug
kivicare-clinic-management-system
Published
2023-06-05
Title
KiviCare Management System < 3.2.1 - Subscriber+ Sensitive Information Disclosure
Slug
kivicare-clinic-management-system
Published
2024-06-03
Title
KiviCare < 3.6.7 - Patient+ Insecure Direct Object Reference
Slug
kivicare-clinic-management-system
Published
2024-12-05
Title
KiviCare – Clinic & Patient Management System (EHR) < 3.6.5 - Unauthenticated SQL Injection
Slug
kivicare-clinic-management-system
Published
2024-12-05
Title
KiviCare – Clinic & Patient Management System (EHR) < 3.6.5 - Authenticated (Doctor/Receptionist+) SQL Injection
Slug
kivicare-clinic-management-system
Published
2024-12-05
Title
KiviCare – Clinic & Patient Management System (EHR) < 3.6.5 - Authenticated (Subscriber+) SQL Injection
Slug
kivicare-clinic-management-system
Published
2025-02-27
Title
KiviCare – Clinic & Patient Management System (EHR) < 3.6.8 - Authenticated (Doctor+) SQL Injection via 'u_id' Parameter
Slug
kivicare-clinic-management-system
Published
2025-11-27
Title
KiviCare < 3.6.14 - Authenticated (Patient+) SQL Injection
Slug
kivicare-clinic-management-system
Published
2026-01-22
Title
KiviCare – Clinic & Patient Management System (EHR) < 3.6.16 - Missing Authorization to Unauthenticated Limited Arbitrary File Upload
Slug
kivicare-clinic-management-system
Published
2026-02-01
Title
KiviCare < 4.0.0 - Authenticated (Receptionist+) SQL Injection
Slug
kivicare-clinic-management-system
Published
2026-03-17
Title
KiviCare < 4.1.3 - Missing Authorization to Unauthenticated Privilege Escalation via Setup Wizard
Slug
kivicare-clinic-management-system
Published
2026-03-17
Title
KiviCare – Clinic & Patient Management System (EHR) < 4.1.3 - Unauthenticated Authentication Bypass via Social Login Token
Slug
kivicare-clinic-management-system
Published
2026-03-23
Title
KiviCare – Clinic & Patient Management System (EHR) < 4.0.0 - Reflected Cross-Site Scripting