Iqonic maintains a small portfolio of WordPress-focused plugins and healthcare management systems, notably KiviCare, WPBookit, and WP Roadmap, that collectively reach a significant installed base despite the vendor's narrow product scope. Vulnerabilities affecting this vendor skew strongly toward critical-severity outcomes and frequently acquire public exploit code, reflecting both the web-application nature of the products and their deployment across accessible WordPress environments. The exposure recurs through weakness classes endemic to web plugins: SQL injection, authorization bypass through user-controlled keys, unrestricted file uploads, missing authorization checks, and cross-site request forgery, each of which can compromise the integrity and confidentiality of hosted data and user accounts. Defenders should prioritize updates for these plugins across their WordPress inventory, as the combination of critical severity and public exploit availability creates immediate risk. Current exploitation activity and exposure counts are shown alongside this summary.
The number and severity of CVEs published that impact products developed by Iqonic over time
Signals from CVEs in this vendor scope (20 CVEs).
20 CVEs · Highest risk first
| CVE | Published | CVSS | Risk | KEV | Exploit |
|---|---|---|---|---|---|
CVE-2024-11728HIGH The KiviCare – Clinic & Patient Management System (EHR) plugin for WordPress is vulnerable to SQL Injection via the 'visit_type[service_id]' parameter of the tax_calculated_data AJ | Dec 6, 2024 | 7.5 | 48 | NO | YES |
CVE-2022-0786CRITICAL The KiviCare WordPress plugin before 2.3.9 does not sanitise and escape some parameters before using them in SQL statements via the ajax_post AJAX action with the get_doctor_detail | Jun 13, 2022 | 9.8 | 48 | NO | YES |
CVE-2025-6058CRITICAL The WPBookit plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the image_upload_handle() function hooked via the 'add_booking_type | Jul 12, 2025 | 9.8 | 43 | NO | YES |
CVE-2025-3810CRITICAL The WPBookit plugin for WordPress is vulnerable to privilege escalation via account takeover in all versions up to, and including, 1.0.2. This is due to the plugin not properly val | May 9, 2025 | 9.8 | 29 | NO | NO |
CVE-2025-3811CRITICAL The WPBookit plugin for WordPress is vulnerable to privilege escalation via account takeover in all versions up to, and including, 1.0.2. This is due to the plugin not properly val | May 9, 2025 | 9.8 | 28 | NO | NO |
CVE-2025-0357CRITICAL The WPBookit plugin for WordPress is vulnerable to arbitrary file uploads due to insufficient file type validation in the 'WPB_Profile_controller::handle_image_upload' function in | Jan 25, 2025 | 9.8 | 28 | NO | NO |
CVE-2024-10215CRITICAL The WPBookit plugin for WordPress is vulnerable to Arbitrary User Password Change in versions up to, and including, 1.6.4. This is due to the plugin providing user-controlled acces | Jan 9, 2025 | 9.8 | 27 | NO | NO |
CVE-2025-6057HIGH The WPBookit plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the handle_image_upload() function in all versions up to, and inclu | Jul 12, 2025 | 8.8 | 26 | NO | NO |
CVE-2024-54280CRITICAL Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Iqonic Design WPBookit wpbookit allows SQL Injection.This issue affects WPBook | Dec 16, 2024 | 9.8 | 26 | NO | NO |
CVE-2023-2628HIGH The KiviCare WordPress plugin before 3.2.1 does not have CSRF checks (either flawed or missing completely) in various AJAX actions, which could allow attackers to make logged in us | Jun 27, 2023 | 8.8 | 26 | NO | NO |
Signals from CVEs in this vendor scope (20 CVEs).
An overview of all social media posts that mention a CVE ID that affects a product developed by Iqonic.
Media articles that mention a CVE ID that affects a product developed by Iqonic — matched by CVE ID, not by vendor name.