KiviCare – Clinic & Patient Management System (EHR) Security & Risk Analysis
wordpress.org/plugins/kivicare-clinic-management-systemKiviCare is an impressive clinic and patient management plugin (EHR).
Is KiviCare – Clinic & Patient Management System (EHR) Safe to Use in 2026?
Mostly Safe
Score 82/100KiviCare – Clinic & Patient Management System (EHR) is generally safe to use. 17 past CVEs were resolved. Keep it updated.
The static analysis of kivicare-clinic-management-system v4.2.0 shows a generally good security posture in terms of its current code, with no identified critical or high severity taint flows and a high percentage of SQL queries using prepared statements and output being properly escaped. The attack surface appears minimal in terms of direct entry points like AJAX handlers, REST API routes, and shortcodes. However, the plugin's history of 13 known CVEs, including a critical and a high severity vulnerability, is a significant concern and indicates a pattern of past security weaknesses. The types of past vulnerabilities, such as SQL Injection, Authorization Bypass, and Cross-Site Scripting, suggest that the plugin has struggled with proper input sanitization and authorization enforcement in its development history. While the current version seems to have addressed immediate code-level risks, the historical context and the presence of a bundled library (dompdf) that could potentially be outdated or contain its own vulnerabilities warrant careful consideration. The existence of cron events without explicit mention of authentication checks on their handlers also presents a potential, albeit unquantified, risk. Overall, the plugin exhibits strengths in its current coding practices but is significantly weakened by its past vulnerability record and the potential for undiscovered issues within bundled libraries or less scrutinized components like cron events.
Key Concerns
- History of 13 known CVEs
- Critical severity past CVE
- High severity past CVE
- Bundled library: dompdf
- Cron events without explicit auth check
KiviCare – Clinic & Patient Management System (EHR) Security Vulnerabilities
CVEs by Year
Severity Breakdown
17 total CVEs
KiviCare – Clinic & Patient Management System (EHR) <= 3.6.16 - Reflected Cross-Site Scripting
KiviCare – Clinic & Patient Management System (EHR) <= 3.6.16 - Missing Authorization
KiviCare – Clinic & Patient Management System (EHR) <= 4.1.2 - Unauthenticated Authentication Bypass via Social Login Token
KiviCare <= 4.1.2 - Missing Authorization to Unauthenticated Privilege Escalation via Setup Wizard
KiviCare <= 3.6.16 - Authenticated (Receptionist+) SQL Injection
KiviCare – Clinic & Patient Management System (EHR) <= 3.6.15 - Missing Authorization to Unauthenticated Limited Arbitrary File Upload
KiviCare <= 3.6.13 - Authenticated (Patient+) SQL Injection
KiviCare – Clinic & Patient Management System (EHR) <= 3.6.7 - Authenticated (Doctor+) SQL Injection via 'u_id' Parameter
KiviCare – Clinic & Patient Management System (EHR) <= 3.6.4 - Authenticated (Doctor/Receptionist+) SQL Injection
KiviCare – Clinic & Patient Management System (EHR) <= 3.6.4 - Unauthenticated SQL Injection
KiviCare – Clinic & Patient Management System (EHR) <= 3.6.4 - Authenticated (Subscriber+) SQL Injection
KiviCare <= 3.6.6 - Authenticated (Patient+) Insecure Direct Object Reference
KiviCare – Clinic & Patient Management System (EHR) <= 3.2.0 - Sensitive Information Exposure
KiviCare – Clinic & Patient Management System (EHR) <= 3.2.0 - Cross-Site Request Forgery
KiviCare – Clinic & Patient Management System (EHR) <= 3.2.0 - Missing Authorization
KiviCare <= 3.2.0 - Reflected Cross-Site Scripting via 'filterType'
KiviCare – Clinic & Patient Management System (EHR) <= 2.3.8 - SQL Injection
KiviCare – Clinic & Patient Management System (EHR) Code Analysis
Bundled Libraries
SQL Query Safety
Output Escaping
Data Flow Analysis
KiviCare – Clinic & Patient Management System (EHR) Attack Surface
WordPress Hooks 90
Scheduled Events 1
Maintenance & Trust
KiviCare – Clinic & Patient Management System (EHR) Maintenance & Trust
Maintenance Signals
Community Trust
KiviCare – Clinic & Patient Management System (EHR) Alternatives
KiviCare – Clinic & Patient Management System (EHR) Developer Profile
5 plugins · 17K total installs
How We Detect KiviCare – Clinic & Patient Management System (EHR)
Patterns used to identify this plugin on WordPress sites during automated security audits and web crawling.
Asset Fingerprints
/wp-content/plugins/kivicare-clinic-management-system/assets/css/kivicare-clinic-management-system-public.css/wp-content/plugins/kivicare-clinic-management-system/assets/css/kivicare-clinic-management-system-rtl.css/wp-content/plugins/kivicare-clinic-management-system/assets/js/kivicare-clinic-management-system-public.js/wp-content/plugins/kivicare-clinic-management-system/assets/js/kivicare-clinic-management-system-rtl.jskivicare-clinic-management-system/assets/js/kivicare-clinic-management-system-public.jskivicare-clinic-management-system/assets/js/kivicare-clinic-management-system-rtl.jskivicare-clinic-management-system/assets/css/kivicare-clinic-management-system-public.css?ver=kivicare-clinic-management-system/assets/css/kivicare-clinic-management-system-rtl.css?ver=kivicare-clinic-management-system/assets/js/kivicare-clinic-management-system-public.js?ver=kivicare-clinic-management-system/assets/js/kivicare-clinic-management-system-rtl.js?ver=HTML / DOM Fingerprints
kivicare-clinic-management-system-wrapperkivicare-appointmentskivicare-patient-registrationkivicare-doctor-profilekivicare-dashboardkivicare-bookingdata-kivicare-modalkiviCare_current_urlkiviCare_ajax_urlKIVICARE_NAMESPACE[kivicare_booking][kivicare_patient_registration][kivicare_doctor_directory][kivicare_appointments]