CVE-2021-34664: 
WordPress vulnerability analysis and mitigation

The Moova for WooCommerce WordPress plugin was found to be vulnerable to Reflected Cross-Site Scripting via the lat parameter in the ~/Checkout/Checkout.php file in versions up to and including 3.5. This vulnerability was discovered and reported by Wordfence (Wordfence Advisory).

The vulnerability is classified as a Reflected Cross-Site Scripting (XSS) issue, identified as CWE-79 (Improper Neutralization of Input During Web Page Generation). The CVSS v3.1 base score is 6.1 (Medium) with the vector string CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N, indicating that the vulnerability can be exploited remotely without authentication but requires user interaction (NVD).

If successfully exploited, this vulnerability allows attackers to inject arbitrary web scripts that execute when users access specifically crafted URLs. This could lead to theft of sensitive information, session hijacking, or other malicious actions performed in the context of the affected user's browser (NVD).

At the time of the vulnerability disclosure, no patch was available for this issue. Users of the affected plugin should consider updating to a newer version if available or implementing additional security controls to prevent XSS attacks (NVD).