Live › vulnerability › CVE-2026-111601
Go to dashboardThe Hippoo Mobile App for WooCommerce WordPress plugin, up to and including version 1.12.0, does not sanitize the token_id parameter before echoing it back. An unauthenticated attacker can craft a link that runs arbitrary script in a victim's browser when they click it.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-23 21:57 UTC. All times on this page are UTC.
Sites running the Hippoo Mobile App for WooCommerce plugin version 1.12.0 or earlier on WordPress with WooCommerce. Exposure requires a victim to open a crafted link while logged in or on the affected site; sites that do not have this plugin installed are not affected.
No product ranges from the sources yet.
wp plugin get hippoo-mobile-app-for-woocommerce --field=version if the plugin slug is unknown, confirm the slug first with wp plugin listwp plugin is-active <slug>1.12.0 once the vendor releases one; unknown whether a fixed version is availablewp plugin deactivate <slug>Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
The Hippoo Mobile App for WooCommerce plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'token_id' parameter in all versions up to, and including, 1.12.0 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link. The URL path regex constrains the path segment to word characters, but WP_REST_Request's query-string parameter precedence allows a ?token_id= value to override it and reach the handler verbatim, bypassing the regex constraint entirely.
This page as .md · .json · in your agent: get_signal("CVE-2026-111601")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.