Iqonic Design vulnerabilities
19 vulnerabilities
Known vulnerabilities in Iqonic Design products, newest first, with CVSS severity, EPSS, KEV listings and ransomware use, across 5 products.
Products
5- Kivicare7 vulnerabilities
- Graphina5 vulnerabilities
- Wpbookit5 vulnerabilities
- WP Roadmap1 vulnerabilities
- WP Roadmap – Product Feedback Board1 vulnerabilities
CVE-2025-52822iqonic designwp roadmap+1
EPSS score0.31%
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Iqonic Design WP Roadmap wp-roadmap allows SQL Injection.This issue affects WP Roadmap: from n/a through <= 2.1.3.CVE-2025-26910iqonic designwpbookit+2EPSS score0.14%
Cross-Site Request Forgery (CSRF) vulnerability in Iqonic Design WPBookit wpbookit allows Stored XSS.This issue affects WPBookit: from n/a through <= 1.0.1.CVE-2025-47533iqonic designgraphina+1EPSS score0.36%
Cross-Site Request Forgery (CSRF) vulnerability in Iqonic Design Graphina graphina-elementor-charts-and-graphs allows PHP Local File Inclusion.This issue affects Graphina: from n/a through <= 3.0.4.CVE-2025-47480iqonic designgraphina+1EPSS score0.33%
Missing Authorization vulnerability in Iqonic Design Graphina graphina-elementor-charts-and-graphs allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Graphina: from n/a through <= 3.0.4.CVE-2025-0357iqonic designwpbookit+2EPSS score1.08%
The WPBookit plugin for WordPress is vulnerable to arbitrary file uploads due to insufficient file type validation in the 'WPB_Profile_controller::handle_image_upload' function in versions up to, and including, 1.6.9. This makes it possible for unauthenticated attackers to upload arbitrary files on the affected site's server which may make remote code execution possible.CVE-2025-66095iqonic designkivicare+1EPSS score0.24%
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Iqonic Design KiviCare kivicare-clinic-management-system allows SQL Injection.This issue affects KiviCare: from n/a through <= 3.6.13.CVE-2025-32254iqonic designwpbookit+2EPSS score0.45%
Missing Authorization vulnerability in Iqonic Design WPBookit wpbookit allows Accessing Functionality Not Properly Constrained by ACLs.This issue affects WPBookit: from n/a through <= 1.0.7.CVE-2024-54280iqonic designwpbookit+2EPSS score0.63%
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Iqonic Design WPBookit wpbookit allows SQL Injection.This issue affects WPBookit: from n/a through <= 1.6.0.CVE-2024-43124iqonic designgraphina+1EPSS score0.26%
Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Iqonic Design Graphina allows Stored XSS.This issue affects Graphina: from n/a through 1.8.10.CVE-2024-10215iqonic designwpbookit+2EPSS score0.68%
The WPBookit plugin for WordPress is vulnerable to Arbitrary User Password Change in versions up to, and including, 1.6.4. This is due to the plugin providing user-controlled access to objects, letting a user bypass authorization and access system resources. This makes it possible for unauthenticated attackers to change user passwords and potentially take over administrator accounts.CVE-2024-35659iqonic designkivicare+2EPSS score0.34%
Missing Authorization vulnerability in Iqonic Design KiviCare kivicare-clinic-management-system allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects KiviCare: from n/a through <= 3.6.6.CVE-2026-40792iqonic designkivicare+1EPSS score0.26%
Subscriber Insecure Direct Object References (IDOR) in KiviCare <= 4.2.1 versions.CVE-2026-65529iqonic designgraphina+1EPSS score0.31%
Unauthenticated Broken Access Control in Graphina <= 3.1.12 versions.CVE-2026-42735iqonic designkivicare+1EPSS score0.44%
Authentication Bypass Using an Alternate Path or Channel vulnerability in Iqonic Design KiviCare kivicare-clinic-management-system allows Password Recovery Exploitation.This issue affects KiviCare: from n/a through <= 4.3.0.CVE-2026-39769iqonic designgraphina+1EPSS score0.48%
Unauthenticated Broken Authentication in Graphina <= 3.1.12 versions.CVE-2026-25383iqonic designkivicare+1EPSS score0.18%
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Iqonic Design KiviCare kivicare-clinic-management-system allows Reflected XSS.This issue affects KiviCare: from n/a through <= 3.6.16.CVE-2026-25022iqonic designkivicare+1EPSS score0.24%
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Iqonic Design KiviCare kivicare-clinic-management-system allows Blind SQL Injection.This issue affects KiviCare: from n/a through <= 3.6.16.CVE-2026-25034iqonic designkivicare+1EPSS score0.19%
Missing Authorization vulnerability in Iqonic Design KiviCare kivicare-clinic-management-system allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects KiviCare: from n/a through <= 3.6.16.CVE-2023-41128iqonic designwp roadmap – product feedback board+2EPSS score0.39%
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Iqonic Design WP Roadmap – Product Feedback Board allows Stored XSS.This issue affects WP Roadmap – Product Feedback Board: from n/a through 1.0.8.