CVE-2023-54358

Received Received - Intake

Reflected XSS in WordPress Adivaha Travel Plugin Allows Session Hijacking

Publication date: 2026-04-09

Last updated on: 2026-04-09

Assigner: VulnCheck

Description

WordPress adivaha Travel Plugin 2.3 contains a reflected cross-site scripting vulnerability that allows unauthenticated attackers to inject malicious scripts by manipulating the isMobile parameter. Attackers can craft malicious URLs containing JavaScript payloads in the isMobile GET parameter at the /mobile-app/v3/ endpoint to execute arbitrary code in victims' browsers and steal session tokens or credentials.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-04-09

Last Modified

2026-04-09

Generated

2026-07-06

AI Q&A

2026-04-10

EPSS Evaluated

2026-07-04

NVD

CVE-2023-54358

Affected Vendors & Products

Vendor	Product	Version / Range
adivaha	travel_plugin	2.3

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-79	The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

Attack-Flow Graph

Executive Summary

This vulnerability exists in the WordPress adivaha Travel Plugin version 2.3 and is a reflected cross-site scripting (XSS) flaw. It allows unauthenticated attackers to inject malicious scripts by manipulating the isMobile parameter in the URL. Specifically, attackers can craft malicious URLs with JavaScript payloads in the isMobile GET parameter at the /mobile-app/v3/ endpoint. When a victim accesses such a URL, the malicious script executes in their browser.

Impact Analysis

The impact of this vulnerability includes the execution of arbitrary code in the victim's browser. This can lead to attackers stealing session tokens or credentials, potentially allowing unauthorized access to user accounts or sensitive information. Because the attack requires only that a victim clicks a crafted URL, it can be exploited without authentication.

Compliance Impact

The vulnerability allows unauthenticated attackers to execute arbitrary scripts in victims' browsers and steal session tokens or credentials. This can lead to unauthorized access to personal data, which may impact compliance with data protection regulations such as GDPR and HIPAA by potentially exposing sensitive user information.

However, specific details on how this vulnerability affects compliance with these standards are not provided in the available information.

Hi! I’m here to help you understand CVE-2023-54358. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70