Reflected Cross-Site Scripting in Hippoo Mobile App for WooCommerce

CVE-2026-111601

What is CVE-2026-111601?

The Hippoo Mobile App for WooCommerce plugin for WordPress has a vulnerability that allows reflected cross-site scripting through the 'token_id' parameter. This issue arises due to inadequate input sanitization and output escaping across all versions up to and including 1.12.0. Attackers can exploit this vulnerability by crafting a link that, when clicked by an authenticated user, injects arbitrary web scripts into the page. The URL path regex limits the path segment but is bypassed by the WP_REST_Request's query-string parameter precedence, allowing unfiltered access to the handler.

References