CVE-2023-54358
Received Received - Intake
Reflected XSS in WordPress Adivaha Travel Plugin Allows Session Hijacking

Publication date: 2026-04-09

Last updated on: 2026-04-09

Assigner: VulnCheck

Description
WordPress adivaha Travel Plugin 2.3 contains a reflected cross-site scripting vulnerability that allows unauthenticated attackers to inject malicious scripts by manipulating the isMobile parameter. Attackers can craft malicious URLs containing JavaScript payloads in the isMobile GET parameter at the /mobile-app/v3/ endpoint to execute arbitrary code in victims' browsers and steal session tokens or credentials.
CVSS Scores
EPSS Scores
Probability:
Percentile:
Meta Information
Published
2026-04-09
Last Modified
2026-04-09
Generated
2026-06-16
AI Q&A
2026-04-10
EPSS Evaluated
2026-06-14
NVD
CVE-2023-54358
Affected Vendors & Products
Showing 1 associated CPE
Vendor Product Version / Range
adivaha travel_plugin 2.3
Helpful Resources
Exploitability
CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-79 The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
Attack-Flow Graph
AI Quick Actions
Instant insights powered by AI
Executive Summary

This vulnerability exists in the WordPress adivaha Travel Plugin version 2.3 and is a reflected cross-site scripting (XSS) flaw. It allows unauthenticated attackers to inject malicious scripts by manipulating the isMobile parameter in the URL. Specifically, attackers can craft malicious URLs with JavaScript payloads in the isMobile GET parameter at the /mobile-app/v3/ endpoint. When a victim accesses such a URL, the malicious script executes in their browser.

Impact Analysis

The impact of this vulnerability includes the execution of arbitrary code in the victim's browser. This can lead to attackers stealing session tokens or credentials, potentially allowing unauthorized access to user accounts or sensitive information. Because the attack requires only that a victim clicks a crafted URL, it can be exploited without authentication.

Compliance Impact

The vulnerability allows unauthenticated attackers to execute arbitrary scripts in victims' browsers and steal session tokens or credentials. This can lead to unauthorized access to personal data, which may impact compliance with data protection regulations such as GDPR and HIPAA by potentially exposing sensitive user information.

However, specific details on how this vulnerability affects compliance with these standards are not provided in the available information.

Chat Assistant
Ask questions about this CVE
Hi! I’m here to help you understand CVE-2023-54358. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70
EPSS Chart