CVE-2026-111601

The Hippoo Mobile App for WooCommerce plugin for WordPress is vulnerable to Reflected Cross-Site Scripting (XSS) in all versions up to and including 1.12.0 . The root cause is insufficient input sanitization and output escaping of the 'token_id' parameter. Specifically, while the URL path regex c...