Reflected cross-site scripting in Hippoo Mobile App for WooCommerce
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- Required
- Attack complexity
- Low
- Impact type
- Cross-site scripting
- Confidentiality · integrity · availability
- Low · Low · None
- Fix status
- No fix listed
Attack profile from CVSS 3.1 · CNA. Fix status from CNA. Impact type from CWE-79.
Summary
The Hippoo Mobile App for WooCommerce plugin for WordPress is vulnerable to reflected cross-site scripting through the 'token_id' parameter in all versions up to and including 1.12.0. Insufficient input sanitization and output escaping (CWE-79) let unauthenticated attackers inject arbitrary web scripts into pages that execute if a user is tricked into clicking a link.
Written with Claude Haiku 5.5 from the sources below · 2026-10-28
Description from the CNA
The Hippoo Mobile App for WooCommerce plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'token_id' parameter in all versions up to, and including, 1.12.0 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link. The URL path regex constrains the path segment to word characters, but WP_REST_Request's query-string parameter precedence allows a ?token_id= value to override it and reach the handler verbatim, bypassing the regex constraint entirely.
Why it matters now
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- None
- Automatable
- No
- Technical impact
- Partial
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
Remediation
The sources list no fixed version for Hippoo Mobile App for WooCommerce.
Written with Claude Haiku 5.5 from the sources below · 2026-10-28
Timeline
- 2026-10-18 Threatist record created from CVE-2026-111601
- 2026-10-18 Alias added: GHSA-2wvf-fwmx-3fj2
References
Other 5
- https://www.wordfence.com/threat-intel/vulnerabilities/id/3c9c41af-0211-4a53-9ef4-b9392b2e9463?source=cve
- https://plugins.trac.wordpress.org/browser/hippoo/tags/1.12.0/app/rest.php#L424
- https://plugins.trac.wordpress.org/browser/hippoo/tags/1.12.0/app/rest.php#L422
- https://plugins.trac.wordpress.org/browser/hippoo/tags/1.12.0/app/rest.php#L189
- https://plugins.trac.wordpress.org/changeset/3739429/hippoo/trunk/app/rest.php
More hippooo vulnerabilities
- TI-2026-09098 Improper authorization in hippooo Hippoo Mobile App for WooCommerce CVSS 3.1CRITICAL 9.8
- TI-2025-12195 Hippoo Mobile App for WooCommerce <= 1.7.1 - Unauthenticated Arbitrary File Read CVSS 3.1HIGH 7.5
- TI-2026-36291 WordPress Hippoo Mobile App for WooCommerce plugin <= 1.9.5 - Broken Access Control vulnerability CVSS 3.1HIGH 8.2
- TI-2026-74369 Reflected XSS in Hippoo Mobile App for WooCommerce WordPress plugin CVSS 3.1HIGH 7.1
- TI-2025-11607 Hippoo Mobile App for WooCommerce <= 1.7.1 - Missing Authorization to Unauthenticated Limited File Write CVSS 3.1MEDIUM 5.3
Sources
- CVE-2026-111601 · CVE Program
- CVE-2026-111601 · NVD
- FIRST EPSS
- GHSA-2wvf-fwmx-3fj2 · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences