Medium · 6.1 CVE-2021-36914 EUVD-2021-23490GHSA-hmc6-55c7-7cq8

WordPress CalderaWP License Manager plugin <= 1.2.11 - Cross-Site Request Forgery (CSRF) vulnerability leading to Reflected Cross-Site Scripting (XSS)

Published Apr 12, 2022 · Updated Apr 28, 2026 · Assigned by Patchstack

Vendor: Desertsnowman, Shelob9 Product: CalderaWP License Manager (WordPress plugin) Category: Web / CMS

Description

Cross-Site Request Forgery (CSRF) vulnerability leading to Reflected Cross-Site Scripting (XSS) in CalderaWP License Manager (WordPress plugin) <= 1.2.11.

Affected products

Vendor	Product	Affected	Fixed
Desertsnowman, Shelob9	CalderaWP License Manager (WordPress plugin)	<= 1.2.11 – ≤ 1.2.11	—

References

https://github.com/CalderaWP/calderawp-license-manager
https://patchstack.com/database/vulnerability/calderawp-license-manager/wordpress-calderawp-license-manager-plugin-1-2-11-cross-site-request-forgery-csrf-vulnerability-leading-to-reflected-cross-site-scripting-xss