CVE-2023-54358
Reflected XSS in WordPress Adivaha Travel Plugin Allows Session Hijacking
Publication date: 2026-04-09
Last updated on: 2026-04-09
Assigner: VulnCheck
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| adivaha | travel_plugin | 2.3 |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-79 | The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users. |
Attack-Flow Graph
AI Powered Q&A
How does this vulnerability affect compliance with common standards and regulations (like GDPR, HIPAA)?:
The vulnerability allows unauthenticated attackers to execute arbitrary scripts in victims' browsers and steal session tokens or credentials. This can lead to unauthorized access to personal data, which may impact compliance with data protection regulations such as GDPR and HIPAA by potentially exposing sensitive user information.
However, specific details on how this vulnerability affects compliance with these standards are not provided in the available information.
Can you explain this vulnerability to me?
This vulnerability exists in the WordPress adivaha Travel Plugin version 2.3 and is a reflected cross-site scripting (XSS) flaw. It allows unauthenticated attackers to inject malicious scripts by manipulating the isMobile parameter in the URL. Specifically, attackers can craft malicious URLs with JavaScript payloads in the isMobile GET parameter at the /mobile-app/v3/ endpoint. When a victim accesses such a URL, the malicious script executes in their browser.
How can this vulnerability impact me? :
The impact of this vulnerability includes the execution of arbitrary code in the victim's browser. This can lead to attackers stealing session tokens or credentials, potentially allowing unauthorized access to user accounts or sensitive information. Because the attack requires only that a victim clicks a crafted URL, it can be exploited without authentication.