Threat database

The Hippoo Mobile App for WooCommerce WordPress plugin is vulnerable to reflected cross-site scripting (XSS) via the 'token_id' parameter in all versions up to and including 1.12.0. This vulnerability arises from insufficient input sanitization and output escaping, allowing unauthenticated attackers to inject arbitrary scripts that execute when a user interacts with a crafted link. The vulnerability bypasses URL path regex constraints due to query-string parameter precedence in WP_REST_Request.

CVE-2026-108483 is a high-severity reflected cross-site scripting (XSS) vulnerability in the hippooo Hippoo Mobile App for WooCommerce. It affects versions from initial releases up to and including 1.12.0. The flaw involves improper neutralization of input during web page generation, allowing an attacker to inject malicious scripts that can execute in the context of the victim's browser. This vulnerability can lead to partial confidentiality, integrity, and availability impacts. No patch or remediation information is provided in the available data.

Unauthenticated Broken Access Control in Hippoo Mobile App for WooCommerce <= 1.9.5 versions.

The Hippoo Mobile App for WooCommerce WordPress plugin up to version 1.9.4 contains an authentication bypass vulnerability that allows unauthenticated attackers to gain administrator privileges. This occurs due to a logic error in permission handling functions that causes all REST API routes under /wc-hippoo/v1/ext/ to be accessible without authentication. Attackers can reset any WordPress user's password, including administrators, by sending a crafted POST request, leading to full site takeover.

The Hippoo Mobile App for WooCommerce plugin for WordPress is vulnerable to arbitrary file write via a missing authorization check in all versions up to, and including, 1.7.1. This is due to the REST API endpoint `/wp-json/hippoo/v1/wc/token/save_callback/{token_id}` being registered with `permission_callback => '__return_true'`, which allows unauthenticated access. This makes it possible for unauthenticated attackers to write arbitrary JSON content to the server's publicly accessible upload directory via the vulnerable endpoint.

The Hippoo Mobile App for WooCommerce plugin for WordPress is vulnerable to Path Traversal in all versions up to, and including, 1.7.1 via the template_redirect() function. This makes it possible for unauthenticated attackers to read the contents of arbitrary files on the server, which can contain sensitive information.