What’s Vulnerable › Vulnerabilities

CVE-2021-36914: WordPress CalderaWP License Manager plugin <= 1.2.11 - Cross-Site Request Forgery (CSRF) vulnerability leading to Reflected Cross-Site Scripting (XSS)

• Severity: medium (CVSS 6.1 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.5% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2022-04-12 · updated 2026-06-17
• Weakness: CWE-79

Description

Cross-Site Request Forgery (CSRF) vulnerability leading to Reflected Cross-Site Scripting (XSS) in CalderaWP License Manager (WordPress plugin) <= 1.2.11.

Affected products

• Desertsnowman, Shelob9 CalderaWP License Manager (WordPress plugin): through 1.2.11

References

• https://github.com/CalderaWP/calderawp-license-manager
• https://patchstack.com/database/vulnerability/calderawp-license-manager/wordpress-calderawp-license-manager-plugin-1-2-11-cross-site-request-forgery-csrf-vulnerability-leading-to-reflected-cross-site-scripting-xss
• https://github.com/CalderaWP/calderawp-license-manager
• https://patchstack.com/database/vulnerability/calderawp-license-manager/wordpress-calderawp-license-manager-plugin-1-2-11-cross-site-request-forgery-csrf-vulnerability-leading-to-reflected-cross-site-scripting-xss

Get alerted when CVE-2021-36914 or the next vulnerability affects your stack