CVE-2021-36914: 
WordPress vulnerability analysis and mitigation

Cross-Site Request Forgery (CSRF) vulnerability leading to Reflected Cross-Site Scripting (XSS) was discovered in CalderaWP License Manager WordPress plugin versions up to and including 1.2.11. The vulnerability was assigned CVE-2021-36914 and was publicly disclosed on April 12, 2022 (NVD, Patchstack).

The vulnerability combines two security issues: Cross-Site Request Forgery (CWE-352) and Reflected Cross-Site Scripting (CWE-79). The CVSS v3.1 base score is 6.1 (Medium) with the vector string CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N. The plugin does not properly sanitize and escape certain parameters before outputting them back to users (WPScan).

The vulnerability could allow malicious actors to force higher privileged users to execute unwanted actions under their current authentication through CSRF, while also potentially executing arbitrary JavaScript code in victims' browsers through the XSS component (Patchstack).

No official fix has been released for this vulnerability as of the disclosure date. Users are advised to consider implementing general security best practices and potentially removing or disabling the plugin if not essential (Patchstack).