Iqonicdesign vulnerabilities
31 CVEs and advisories name Iqonicdesign as an affected vendor, newest first. Follow it as a feed.
- CVE-2026-110291Graphina <= 3.1.13 - Unauthenticated Stored Cross-Site Scripting via Tree Chart Widget Settings
- CVE-2026-13709Graphina <= 3.1.11 - Authenticated (Author+) Stored Cross-Site Scripting via 'iq_tree_tree_chart_template' Widget Setting
- CVE-2026-15453KiviCare <= 4.5.1 - Authenticated (Doctor+) SQL Injection via 'searchTerm' Parameter
- CVE-2026-15072KiviCare <= 4.5.0 - Authenticated (Doctor+) SQL Injection via 'orderby' Parameter in KCQueryBuilder
- CVE-2026-15073KiviCare <= 4.5.0 - Authenticated (Doctor+) SQL Injection via 'orderby' Parameter in DoctorSessionController
- CVE-2026-11990KiviCare <= 4.4.0 - Missing Authorization to Unauthenticated Payment Bypass and Appointment Status Manipulation via /payment-success REST Endpoint
- CVE-2026-25414WordPress WPBookit Pro plugin <= 1.6.18 - Privilege Escalation vulnerability
- CVE-2026-25413WordPress WPBookit Pro plugin <= 1.6.18 - Arbitrary File Upload vulnerability
- CVE-2026-2992KiviCare <= 4.1.2 - Missing Authorization to Unauthenticated Privilege Escalation via Setup Wizard
- CVE-2026-2991KiviCare – Clinic & Patient Management System (EHR) <= 4.1.2 - Unauthenticated Authentication Bypass via Social Login Token
- CVE-2026-1980WPBookit <= 1.0.8 - Missing Authorization to Unauthenticated Sensitive Customer Data Exposure
- CVE-2026-1945WPBookit <= 1.0.8 - Unauthenticated Stored Cross-Site Scripting via 'wpb_user_name' and 'wpb_user_email' Parameters
- CVE-2026-25415WordPress WPBookit Pro plugin <= 1.6.18 - Broken Access Control vulnerability
- CVE-2026-0927KiviCare – Clinic & Patient Management System (EHR) <= 3.6.15 - Missing Authorization to Unauthenticated Limited Arbitrary File Upload
- CVE-2025-12135WPBookit <= 1.0.6 - Unauthenticated Stored Cross-Site Scripting
- CVE-2025-11820Graphina – Elementor Charts and Graphs <= 3.1.8 - Authenticated (Contributor+) Stored Cross-Site Scripting via Chart Widgets
- CVE-2025-8867Graphina - Elementor Charts and Graphs <= 3.1.3 - Authenticated (Contributor+) Stored Cross-Site Scripting
- CVE-2025-7852WPBookit <= 1.0.6 - Unauthenticated Arbitrary File Upload via image_upload_handle Function
- CVE-2025-6057WPBookit <= 1.0.4 - Authenticated (Subscriber+) Arbitrary File Upload
- CVE-2025-6058WPBookit <= 1.0.4 - Unauthenticated Arbitrary File Upload
- CVE-2025-3811WPBookit <= 1.0.2 - Insecure Direct Object Reference to Unauthenticated Privilege Escalation via Email Update
- CVE-2025-3810WPBookit <= 1.0.2 - Insecure Direct Object Reference to Unauthenticated Privilege Escalation via Account Takeover
- CVE-2025-2519Streamit <= 4.0.1 - Authenticated (Subscriber+) Arbitrary File Download
- CVE-2025-2525Streamit <= 4.0.1 - Authenticated (Subscriber+) Arbitrary File Upload
- CVE-2025-2526Streamit <= 4.0.2 - Authenticated (Subscriber+) Privilege Escalation via User Email Change/Account Takeover
- CVE-2025-1572KiviCare – Clinic & Patient Management System (EHR) <= 3.6.7 - Authenticated (Doctor+) SQL Injection via 'u_id' Parameter
- CVE-2024-13529SocialV - Social Network and Community BuddyPress Theme <= 2.0.15 - Missing Authorization to Arbitrary File Download
- CVE-2024-11729KiviCare – Clinic & Patient Management System (EHR) <= 3.6.4 - Authenticated (Subscriber+) SQL Injection
- CVE-2024-11730KiviCare – Clinic & Patient Management System (EHR) <= 3.6.4 - Authenticated (Doctor/Receptionist+) SQL Injection
- CVE-2024-11728KiviCare – Clinic & Patient Management System (EHR) <= 3.6.4 - Unauthenticated SQL Injection