CVE-2023-54358

WordPress adivaha Travel Plugin 2.3 Reflected XSS via isMobile

CVSS 5.1 MEDIUMEPSS 0.3%CWE-79

Vexday Risk Score

33Attention

SSVC decision (CISA)

Attend

PoC available → attend closely

CVSS 5.1EPSS 0.3%KEV nãoPoC públicaNuclei —Metasploit —Patch —

Lifecycle

09 Apr 2026Published on NVD

Recommendation: Plan a near-term fix — a public PoC already exists.

WordPress adivaha Travel Plugin 2.3 contains a reflected cross-site scripting vulnerability that allows unauthenticated attackers to inject malicious scripts by manipulating the isMobile parameter. Attackers can craft malicious URLs containing JavaScript payloads in the isMobile GET parameter at the /mobile-app/v3/ endpoint to execute arbitrary code in victims' browsers and steal session tokens or credentials.

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N

Affected products

Adivaha · WordPress adivaha Travel Plugin

public PoCs found — 1

cve_referencewww.exploit-db.com/exploits/51663unverified

⚠ Public resources, to assess the exposure of systems you control or are authorized to test. Test only with authorization.

References

https://wordpress.org/plugins/adiaha-hotel/https://www.adivaha.com/https://www.exploit-db.com/exploits/51663 https://www.vulncheck.com/advisories/wordpress-adivaha-travel-plugin-reflected-xss-via-ismobile