CVE-2026-111601: CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in hippooo Hippoo Mobile App for WooCommerce

CVE-2026-111601 describes a reflected cross-site scripting vulnerability in the Hippoo Mobile App for WooCommerce WordPress plugin. The vulnerability exists in the handling of the 'token_id' parameter, which is insufficiently sanitized and escaped, allowing injection of arbitrary web scripts. Although the URL path regex restricts the path segment to word characters, the WP_REST_Request query-string parameter precedence allows the 'token_id' value to override this constraint and reach the handler verbatim. This flaw affects all plugin versions from 0 up to and including 1.12.0.

An unauthenticated attacker can exploit this vulnerability by tricking a user into clicking a crafted link containing malicious scripts in the 'token_id' parameter. Successful exploitation can lead to execution of arbitrary scripts in the context of the victim's browser, potentially resulting in information disclosure or session hijacking. The CVSS 3.1 base score is 6.1 (medium severity), reflecting network attack vector, low attack complexity, no privileges required, user interaction required, scope change, and low confidentiality and integrity impacts with no availability impact.

No official patch or fix is currently documented for this vulnerability. Users should monitor the vendor's advisories for updates. Until a fix is available, avoid clicking on suspicious links containing the 'token_id' parameter and consider implementing web application firewall (WAF) rules to detect and block malicious payloads targeting this parameter.