CVE-2026-13613

Name of the Vulnerable Software and Affected Versions KiviCare WordPress plugin versions prior to 4.5.2

Description Authenticated users with a clinic staff-level role can perform SQL injection because the software fails to properly sanitize and escape user-supplied parameters before incorporating them into a SQL query. SQL injection is a technique where malicious SQL statements are inserted into entry fields for execution, potentially allowing unauthorized access to the database.

Recommendations Update KiviCare WordPress plugin to version 4.5.2 or later.