CVE-2023-54358

Name of the Vulnerable Software and Affected Versions WordPress adivaha Travel Plugin version 2.3

Description The WordPress adivaha Travel Plugin version 2.3 contains a reflected cross-site scripting issue that allows unauthenticated attackers to inject malicious scripts. Attackers can manipulate the isMobile parameter in the /mobile-app/v3/ endpoint to execute arbitrary code in victims' browsers and potentially steal session tokens or credentials.

Recommendations Update WordPress adivaha Travel Plugin to a newer version that contains a fix for this vulnerability. As a temporary workaround, avoid using the /mobile-app/v3/ endpoint with untrusted input for the isMobile parameter.