Iiqonicdesign

Products

Exploited and recent CVEs

• CVE-2026-13709 Medium 6.4 Graphina <= 3.1.11 - Authenticated (Author+) Stored Cross-Site Scripting via 'iq_tree_tree_chart_template' Widget Setting 0.3%
• CVE-2026-15453 Medium 6.5 KiviCare <= 4.5.1 - Authenticated (Doctor+) SQL Injection via 'searchTerm' Parameter 0.4%
• CVE-2026-15072 Medium 6.5 KiviCare <= 4.5.0 - Authenticated (Doctor+) SQL Injection via 'orderby' Parameter in KCQueryBuilder 0.5%
• CVE-2026-15073 Medium 6.5 KiviCare <= 4.5.0 - Authenticated (Doctor+) SQL Injection via 'orderby' Parameter in DoctorSessionController 0.4%
• CVE-2026-11990 Medium 5.3 KiviCare <= 4.4.0 - Missing Authorization to Unauthenticated Payment Bypass and Appointment Status Manipulation via /payment-success REST Endpoint 0.6%
• CVE-2026-25414 High 8.8 WordPress WPBookit Pro plugin <= 1.6.18 - Privilege Escalation vulnerability 0.3%
• CVE-2026-25413 Critical 9.9 WordPress WPBookit Pro plugin <= 1.6.18 - Arbitrary File Upload vulnerability 0.3%
• CVE-2026-2992 High 8.2 KiviCare <= 4.1.2 - Missing Authorization to Unauthenticated Privilege Escalation via Setup Wizard 0.3%
• CVE-2026-2991 High 7.3 KiviCare – Clinic & Patient Management System (EHR) <= 4.1.2 - Unauthenticated Authentication Bypass via Social Login Token 0.5%
• CVE-2026-1980 Medium 5.3 WPBookit <= 1.0.8 - Missing Authorization to Unauthenticated Sensitive Customer Data Exposure 0.9%
• CVE-2026-1945 High 7.2 WPBookit <= 1.0.8 - Unauthenticated Stored Cross-Site Scripting via 'wpb_user_name' and 'wpb_user_email' Parameters 0.4%
• CVE-2026-25415 Medium 5.3 WordPress WPBookit Pro plugin <= 1.6.18 - Broken Access Control vulnerability 0.2%
• CVE-2026-0927 Medium 5.3 KiviCare – Clinic & Patient Management System (EHR) <= 3.6.15 - Missing Authorization to Unauthenticated Limited Arbitrary File Upload 0.3%
• CVE-2025-12135 High 7.2 WPBookit <= 1.0.6 - Unauthenticated Stored Cross-Site Scripting 0.3%
• CVE-2025-11820 Medium 6.4 Graphina – Elementor Charts and Graphs <= 3.1.8 - Authenticated (Contributor+) Stored Cross-Site Scripting via Chart Widgets 0.2%
• CVE-2025-8867 Medium 6.4 Graphina - Elementor Charts and Graphs <= 3.1.3 - Authenticated (Contributor+) Stored Cross-Site Scripting 0.5%
• CVE-2025-7852 Critical 9.8 WPBookit <= 1.0.6 - Unauthenticated Arbitrary File Upload via image_upload_handle Function 1.6%
• CVE-2025-6057 High 8.8 WPBookit <= 1.0.4 - Authenticated (Subscriber+) Arbitrary File Upload 0.8%
• CVE-2025-6058 Critical 9.8 WPBookit <= 1.0.4 - Unauthenticated Arbitrary File Upload 6.2%
• CVE-2025-3811 Critical 9.8 WPBookit <= 1.0.2 - Insecure Direct Object Reference to Unauthenticated Privilege Escalation via Email Update 0.8%
• CVE-2025-3810 Critical 9.8 WPBookit <= 1.0.2 - Insecure Direct Object Reference to Unauthenticated Privilege Escalation via Account Takeover 0.8%
• CVE-2025-2519 Medium 6.5 Streamit <= 4.0.1 - Authenticated (Subscriber+) Arbitrary File Download 0.5%
• CVE-2025-2525 High 8.8 Streamit <= 4.0.1 - Authenticated (Subscriber+) Arbitrary File Upload 1.0%
• CVE-2025-2526 High 8.8 Streamit <= 4.0.2 - Authenticated (Subscriber+) Privilege Escalation via User Email Change/Account Takeover 0.6%
• CVE-2025-1572 Medium 6.5 KiviCare – Clinic & Patient Management System (EHR) <= 3.6.7 - Authenticated (Doctor+) SQL Injection via 'u_id' Parameter 0.5%
• CVE-2024-13529 Medium 6.5 SocialV - Social Network and Community BuddyPress Theme <= 2.0.15 - Missing Authorization to Arbitrary File Download 0.4%
• CVE-2024-11729 Medium 6.5 KiviCare – Clinic & Patient Management System (EHR) <= 3.6.4 - Authenticated (Subscriber+) SQL Injection 0.6%
• CVE-2024-11730 Medium 6.5 KiviCare – Clinic & Patient Management System (EHR) <= 3.6.4 - Authenticated (Doctor/Receptionist+) SQL Injection 0.4%
• CVE-2024-11728 High 7.5 KiviCare – Clinic & Patient Management System (EHR) <= 3.6.4 - Unauthenticated SQL Injection 13.6%
• CVE-2024-4574 Medium 6.4 Graphina – Elementor Charts and Graphs <= 1.8.9 - Authenticated (Contributor+) Stored Cross-Site Scripting via Multiple Widgets 0.6%