CVE-2026-111601 in Hippoo Mobile App Plugin
Summary
by MITRE • 10/17/2026
The Hippoo Mobile App for WooCommerce plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'token_id' parameter in all versions up to, and including, 1.12.0 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link. The URL path regex constrains the path segment to word characters, but WP_REST_Request's query-string parameter precedence allows a ?token_id= value to override it and reach the handler verbatim, bypassing the regex constraint entirely.
Once again VulDB remains the best source for vulnerability data.
Analysis
by VulDB Data Team • 10/17/2026
The Hippoo Mobile App for WooCommerce plugin for WordPress contains a critical security vulnerability classified as Reflected Cross-Site Scripting within all versions up to 1.12.0. This flaw stems from insufficient input sanitization and output escaping mechanisms when processing the token_id parameter in REST API requests. The vulnerability allows unauthenticated attackers to inject arbitrary web scripts into pages that are subsequently executed by a victim user's browser, provided the attacker can successfully trick the user into performing an action such as clicking on a maliciously crafted link. This type of attack typically leads to session hijacking, credential theft, or defacement depending on the context in which the script executes and the privileges held by the targeted user.
The technical root cause lies in how WordPress handles REST API routing parameters versus query string arguments. The plugin's URL path regex is designed to constrain the path segment to word characters only, ostensibly preventing malicious input from reaching sensitive handlers through the URI structure itself. However, the vulnerability exploits a precedence rule within WP_REST_Request where query-string parameter values override matched path segments. Consequently, an attacker can bypass the restrictive regex constraint entirely by appending ?token_id=<malicious_payload> to the request URL. The server processes this query string value and passes it verbatim to the handler without adequate validation or encoding, resulting in the direct reflection of user-supplied input into the HTML response body.
From a threat modeling perspective, this vulnerability maps directly to CWE-79 Improper Neutralization of Input During Web Page Generation commonly known as Cross-site Scripting. The specific vector aligns with ATT&CK technique T1059 Command and Scripting Interpreter via browser-based execution or potentially T1189 Drive-by Compromise if the payload is designed for automatic exploitation upon page load, though this instance requires user interaction such as clicking a link making it more closely aligned with phishing vectors. The lack of authentication required to exploit this flaw significantly increases its severity because any internet-facing WordPress site running the affected plugin version is immediately vulnerable without needing valid credentials or prior compromise of an administrator account.
The operational impact of this vulnerability extends beyond simple script execution. Attackers can leverage reflected XSS to steal administrative cookies, thereby gaining full control over the WooCommerce store backend. This could lead to unauthorized modification of product listings, theft of customer data including payment information if stored insecurely, and integration with malicious third-party services that exfiltrate sensitive business intelligence. Furthermore because the payload is reflected in the response it can be easily disseminated via social engineering campaigns where victims are lured into visiting a compromised or attacker-controlled URL containing the exploit code.
Mitigation strategies should prioritize immediate patching to version 1.12.1 or later if available from the official plugin repository which likely addresses this input validation gap. In environments where upgrading is not immediately feasible administrators must implement Web Application Firewall rules that detect and block requests containing script tags or common XSS payloads within query parameters specifically targeting token_id fields. Additionally developers should enforce strict output encoding using functions like esc_html_e or wp_kses_post when rendering user-supplied data in HTML contexts ensuring that special characters are converted to their corresponding HTML entities preventing browser interpretation as executable code. Input validation must also be strengthened by rejecting any non-whitelisted character sequences regardless of whether they arrive via path segments or query strings thereby neutralizing the precedence exploit vector entirely.