Skip to content
OpenAdvisories

Vendor

Iqonic Design

48 known vulnerabilities.

Products

WPBookit 13 KiviCare – Clinic & Patient Management System (EHR) 11 KiviCare 7 Graphina – Charts and Graphs For Elementor 5 WPBookit Pro 3 Streamit 3 Graphina 3 WP Roadmap – Product Feedback Board 1 WP Roadmap 1 SocialV - Social Network and Community BuddyPress Theme 1
All Critical High Medium Low Exploited only Public exploit

8 results · Clear filters · Feed

  • Critical 9.9
    CVE-2026-25413

    WordPress WPBookit Pro plugin <= 1.6.18 - Arbitrary File Upload vulnerability

    Unrestricted Upload of File with Dangerous Type vulnerability in iqonicdesign WPBookit Pro wpbookit-pro allows Using Malicious Files.This issue affects WPBookit Pro: from n/a through <= 1.6.18.

    Iqonic Design WPBookit Pro
  • Critical 9.8
    CVE-2025-7852

    WPBookit <= 1.0.6 - Unauthenticated Arbitrary File Upload via image_upload_handle Function

    The WPBookit plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the image_upload_handle() function hooked via the 'add_new_customer' route in all versions up to, and including, 1.0.6. The plugin’s image‐upload …

    Iqonic Design WPBookit Web / CMS
  • Critical 9.8
    CVE-2025-6058 Public exploit Scanner template

    WPBookit <= 1.0.4 - Unauthenticated Arbitrary File Upload

    The WPBookit plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the image_upload_handle() function hooked via the 'add_booking_type' route in all versions up to, and including, 1.0.4. This makes it possible for…

    Iqonic Design WPBookit Web / CMS
  • Critical 9.8
    CVE-2025-3811

    WPBookit <= 1.0.2 - Insecure Direct Object Reference to Unauthenticated Privilege Escalation via Email Update

    The WPBookit plugin for WordPress is vulnerable to privilege escalation via account takeover in all versions up to, and including, 1.0.2. This is due to the plugin not properly validating a user's identity prior to updating their details like email through th…

    Iqonic Design WPBookit Web / CMS
  • Critical 9.8
    CVE-2025-3810

    WPBookit <= 1.0.2 - Insecure Direct Object Reference to Unauthenticated Privilege Escalation via Account Takeover

    The WPBookit plugin for WordPress is vulnerable to privilege escalation via account takeover in all versions up to, and including, 1.0.2. This is due to the plugin not properly validating a user's identity prior to updating their details like password and ema…

    Iqonic Design WPBookit Web / CMS
  • Critical 9.8
    CVE-2025-0357

    WPBookit <= 1.6.9 - Unauthenticated Arbitrary File Upload

    The WPBookit plugin for WordPress is vulnerable to arbitrary file uploads due to insufficient file type validation in the 'WPB_Profile_controller::handle_image_upload' function in versions up to, and including, 1.6.9. This makes it possible for unauthenticate…

    Iqonic Design WPBookit Web / CMS
  • Critical 9.8
    CVE-2024-10215

    WPBookit <= 1.6.4 - Unauthenticated Arbitrary User Password Change

    The WPBookit plugin for WordPress is vulnerable to Arbitrary User Password Change in versions up to, and including, 1.6.4. This is due to the plugin providing user-controlled access to objects, letting a user bypass authorization and access system resources. …

    Iqonic Design WPBookit Web / CMS
  • Critical 9.3
    CVE-2024-54280

    WordPress WPBookit plugin <= 1.6.0 - SQL Injection vulnerability

    Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Iqonic Design WPBookit wpbookit allows SQL Injection.This issue affects WPBookit: from n/a through <= 1.6.0.

    Iqonic Design WPBookit