CVE-2026-108483
HighCVSS 7.1Summary
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in hippooo Hippoo Mobile App for WooCommerce (hippoo) allows Reflected XSS. This issue affects Hippoo Mobile App for WooCommerce: from n/a through 1.12.0.
Risk Assessment
An attacker can trick a user into clicking a crafted link, causing a malicious script to execute in their browser and potentially stealing session data.
Recommendation
Update the Hippoo Mobile App for WooCommerce to a version later than 1.12.0.
Other vulnerabilities in Hippoo Mobile App for WooCommerce
See all- CVE-2026-49065High
The Hippoo mobile app for WooCommerce versions up to 1.9.5 has an issue with unauthenticated access that may lead to broken access control.
- CVE-2025-12655Medium
The Hippoo Mobile App for WooCommerce plugin for WordPress is vulnerable to arbitrary file write via a missing authorization check in all versions up to and including 1.7.1. This is due to the REST API endpoint `/wp-json/hippoo/v1/wc/token/save_callback/{token_id}` being registered with `permission_callback => '__return_true'`, which allows unauthenticated access. This makes it possible for unauthenticated attackers to write arbitrary JSON content to the server's publicly accessible upload directory via the vulnerable endpoint.
Original NVD description (English source)
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in hippooo Hippoo Mobile App for WooCommerce hippoo allows Reflected XSS.This issue affects Hippoo Mobile App for WooCommerce: from n/a through 1.12.0.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS