# cve.now: Iqonicdesign

The newest entries naming Iqonicdesign as an affected vendor (up to 200), of 31 in all, 0 known exploited. Older ones are in the full catalog at https://cve.now/latest.md.

- [CVE-2026-110291](https://cve.now/CVE-2026-110291.md): Graphina \<= 3.1.13 - Unauthenticated Stored Cross-Site Scripting via Tree Chart Widget Settings (CVSS 7.2)
- [CVE-2026-13709](https://cve.now/CVE-2026-13709.md): Graphina \<= 3.1.11 - Authenticated (Author+) Stored Cross-Site Scripting via 'iq\_tree\_tree\_chart\_template' Widget Setting (CVSS 6.4)
- [CVE-2026-15453](https://cve.now/CVE-2026-15453.md): KiviCare \<= 4.5.1 - Authenticated (Doctor+) SQL Injection via 'searchTerm' Parameter (CVSS 6.5)
- [CVE-2026-15072](https://cve.now/CVE-2026-15072.md): KiviCare \<= 4.5.0 - Authenticated (Doctor+) SQL Injection via 'orderby' Parameter in KCQueryBuilder (CVSS 6.5)
- [CVE-2026-15073](https://cve.now/CVE-2026-15073.md): KiviCare \<= 4.5.0 - Authenticated (Doctor+) SQL Injection via 'orderby' Parameter in DoctorSessionController (CVSS 6.5)
- [CVE-2026-11990](https://cve.now/CVE-2026-11990.md): KiviCare \<= 4.4.0 - Missing Authorization to Unauthenticated Payment Bypass and Appointment Status Manipulation via /payment-success REST Endpoint (CVSS 5.3)
- [CVE-2026-25414](https://cve.now/CVE-2026-25414.md): WordPress WPBookit Pro plugin \<= 1.6.18 - Privilege Escalation vulnerability (CVSS 8.8)
- [CVE-2026-25413](https://cve.now/CVE-2026-25413.md): WordPress WPBookit Pro plugin \<= 1.6.18 - Arbitrary File Upload vulnerability (CVSS 9.9)
- [CVE-2026-2992](https://cve.now/CVE-2026-2992.md): KiviCare \<= 4.1.2 - Missing Authorization to Unauthenticated Privilege Escalation via Setup Wizard (CVSS 8.2)
- [CVE-2026-2991](https://cve.now/CVE-2026-2991.md): KiviCare – Clinic & Patient Management System (EHR) \<= 4.1.2 - Unauthenticated Authentication Bypass via Social Login Token (CVSS 7.3)
- [CVE-2026-1980](https://cve.now/CVE-2026-1980.md): WPBookit \<= 1.0.8 - Missing Authorization to Unauthenticated Sensitive Customer Data Exposure (CVSS 5.3)
- [CVE-2026-1945](https://cve.now/CVE-2026-1945.md): WPBookit \<= 1.0.8 - Unauthenticated Stored Cross-Site Scripting via 'wpb\_user\_name' and 'wpb\_user\_email' Parameters (CVSS 7.2)
- [CVE-2026-25415](https://cve.now/CVE-2026-25415.md): WordPress WPBookit Pro plugin \<= 1.6.18 - Broken Access Control vulnerability (CVSS 5.3)
- [CVE-2026-0927](https://cve.now/CVE-2026-0927.md): KiviCare – Clinic & Patient Management System (EHR) \<= 3.6.15 - Missing Authorization to Unauthenticated Limited Arbitrary File Upload (CVSS 5.3)
- [CVE-2025-12135](https://cve.now/CVE-2025-12135.md): WPBookit \<= 1.0.6 - Unauthenticated Stored Cross-Site Scripting (CVSS 7.2)
- [CVE-2025-11820](https://cve.now/CVE-2025-11820.md): Graphina – Elementor Charts and Graphs \<= 3.1.8 - Authenticated (Contributor+) Stored Cross-Site Scripting via Chart Widgets (CVSS 6.4)
- [CVE-2025-8867](https://cve.now/CVE-2025-8867.md): Graphina - Elementor Charts and Graphs \<= 3.1.3 - Authenticated (Contributor+) Stored Cross-Site Scripting (CVSS 6.4)
- [CVE-2025-7852](https://cve.now/CVE-2025-7852.md): WPBookit \<= 1.0.6 - Unauthenticated Arbitrary File Upload via image\_upload\_handle Function (CVSS 9.8)
- [CVE-2025-6057](https://cve.now/CVE-2025-6057.md): WPBookit \<= 1.0.4 - Authenticated (Subscriber+) Arbitrary File Upload (CVSS 8.8)
- [CVE-2025-6058](https://cve.now/CVE-2025-6058.md): WPBookit \<= 1.0.4 - Unauthenticated Arbitrary File Upload (CVSS 9.8)
- [CVE-2025-3811](https://cve.now/CVE-2025-3811.md): WPBookit \<= 1.0.2 - Insecure Direct Object Reference to Unauthenticated Privilege Escalation via Email Update (CVSS 9.8)
- [CVE-2025-3810](https://cve.now/CVE-2025-3810.md): WPBookit \<= 1.0.2 - Insecure Direct Object Reference to Unauthenticated Privilege Escalation via Account Takeover (CVSS 9.8)
- [CVE-2025-2519](https://cve.now/CVE-2025-2519.md): Streamit \<= 4.0.1 - Authenticated (Subscriber+) Arbitrary File Download (CVSS 6.5)
- [CVE-2025-2525](https://cve.now/CVE-2025-2525.md): Streamit \<= 4.0.1 - Authenticated (Subscriber+) Arbitrary File Upload (CVSS 8.8)
- [CVE-2025-2526](https://cve.now/CVE-2025-2526.md): Streamit \<= 4.0.2 - Authenticated (Subscriber+) Privilege Escalation via User Email Change/Account Takeover (CVSS 8.8)
- [CVE-2025-1572](https://cve.now/CVE-2025-1572.md): KiviCare – Clinic & Patient Management System (EHR) \<= 3.6.7 - Authenticated (Doctor+) SQL Injection via 'u\_id' Parameter (CVSS 6.5)
- [CVE-2024-13529](https://cve.now/CVE-2024-13529.md): SocialV - Social Network and Community BuddyPress Theme \<= 2.0.15 - Missing Authorization to Arbitrary File Download (CVSS 6.5)
- [CVE-2024-11729](https://cve.now/CVE-2024-11729.md): KiviCare – Clinic & Patient Management System (EHR) \<= 3.6.4 - Authenticated (Subscriber+) SQL Injection (CVSS 6.5)
- [CVE-2024-11730](https://cve.now/CVE-2024-11730.md): KiviCare – Clinic & Patient Management System (EHR) \<= 3.6.4 - Authenticated (Doctor/Receptionist+) SQL Injection (CVSS 6.5)
- [CVE-2024-11728](https://cve.now/CVE-2024-11728.md): KiviCare – Clinic & Patient Management System (EHR) \<= 3.6.4 - Unauthenticated SQL Injection (CVSS 7.5)
- [CVE-2024-4574](https://cve.now/CVE-2024-4574.md): Graphina – Elementor Charts and Graphs \<= 1.8.9 - Authenticated (Contributor+) Stored Cross-Site Scripting via Multiple Widgets (CVSS 6.4)

---

Source: cve.now
Built by [Sazabi](https://www.sazabi.com/?utm_source=cve-now&utm_medium=markdown), AI-native observability and security: automatic issue detection, plain-language log search and live dashboards.
Page: https://cve.now/vendors/iqonicdesign
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.