52 matches found
By-Poloss..-..CVE-2026-10580
CVE-2026-10580: Hippoo Mobile App for WooCommerce = 1.9.4 - Unauthenticated Authentication Bypass to Admin Takeover Unauthenticated → Administrator Account Takeover via Logic Conflation Bug 📌 Summary | ---|--- CVE| CVE-2026-10580 Plugin| Hippoo Mobile App for WooCommerce Versi| ≤ 1.9.4 CVSS| 9.8...
CVE-2026-10580
WordPress - Hippoo Mobile App for WooCommerce = 1.9.4 - Authentication Bypass to Admin Account Takeover Overview This tool is a proof-of-concept exploit for CVE-2026-10580 , an authentication bypass vulnerability affecting the Hippoo Mobile App for WooCommerce WordPress plugin versions = 1.9.4. T...
Hippoo Mobile App for WooCommerce - Broken Access Control
Hippoo Mobile App for WooCommerce = 1.9.4 contains a broken access control vulnerability caused by incorrect privilege assignment, letting attackers escalate their privileges, exploit requires no special conditions. id: CVE-2026-49060 info: name: Hippoo Mobile App for WooCommerce - Broken Access...
Hippoo Mobile App for WooCommerce <= 1.9.4 - Authentication Bypass to Admin Account Takeover
Hippoo Mobile App for WooCommerce WordPress plugin = 1.9.4 contains an authentication bypass caused by logic conflation in user permission checks, letting unauthenticated attackers take over administrator accounts via REST API password reset. id: CVE-2026-10580 info: name: Hippoo Mobile App for...
Hippoo Mobile App for WooCommerce <= 1.7.1 - Unauthenticated Arbitrary File Read
The Hippoo Mobile App for WooCommerce plugin for WordPress is vulnerable to Path Traversal in all versions up to and including 1.7.1 via the templateredirect function. The plugin registers 'hippooserve' as a WordPress query variable and uses it to serve PWA files from the pwa/ directory. In...
Hippoo-Mobile-App-For-WooCommerce-CVE-Report
Hippoo-Mobile-App-for-WooCommerce-CVE-Report Disclosure for CVE-2025-13339 CVE-2025-13339 - Vulnerability in Hippoo Mobile App for WooCommerce This repository discloses a vulnerability discovered in Hippoo Mobile App for WooCommerce = 1.6.1,WordPress plugin developed by hippooo. 🛠 Affected Versio...
CVE-2026-111601
The Hippoo Mobile App for WooCommerce plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'tokenid' parameter in all versions up to, and including, 1.12.0 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to...
CVE-2026-111601
The Hippoo Mobile App for WooCommerce plugin for WordPress is vulnerable to Reflected Cross-Site Scripting (XSS) in all versions up to and including 1.12.0 . The root cause is insufficient input sanitization and output escaping of the 'token_id' parameter. Specifically, while the URL path regex c...
EUVD-2026-103215
The Hippoo Mobile App for WooCommerce plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'tokenid' parameter in all versions up to, and including, 1.12.0 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to...
CVE-2026-111601 Hippoo Mobile App for WooCommerce <= 1.12.0 - Reflected Cross-Site Scripting via 'token_id' Parameter
The Hippoo Mobile App for WooCommerce plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'tokenid' parameter in all versions up to, and including, 1.12.0 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to...
CVE-2026-111601 Hippoo Mobile App for WooCommerce <= 1.12.0 - Reflected Cross-Site Scripting via 'token_id' Parameter
The Hippoo Mobile App for WooCommerce plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'tokenid' parameter in all versions up to, and including, 1.12.0 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to...
PT-2026-116201
Name of the Vulnerable Software and Affected Versions Hippoo Mobile App for WooCommerce versions prior to 1.13.0 Description Insufficient input sanitization and output escaping allow unauthenticated attackers to perform Reflected Cross-Site Scripting. This occurs when an attacker tricks a user in...
CVE-2026-108483
Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in hippooo Hippoo Mobile App for WooCommerce hippoo allows Reflected XSS.This issue affects Hippoo Mobile App for WooCommerce: from n/a through 1.12.0...
EUVD-2026-101526
Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in hippooo Hippoo Mobile App for WooCommerce hippoo allows Reflected XSS.This issue affects Hippoo Mobile App for WooCommerce: from n/a through 1.12.0...
CVE-2026-108483
The Hippoo Mobile App for WooCommerce WordPress plugin is vulnerable to Reflected Cross-Site Scripting (XSS) due to improper neutralization of input during web page generation. This issue affects versions up to and including 1.12.0 . Exploitation details and specific remediation steps are not pro...
CVE-2026-108483 WordPress Hippoo Mobile App for WooCommerce plugin <= 1.12.0 - Cross Site Scripting (XSS) vulnerability
Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in hippooo Hippoo Mobile App for WooCommerce hippoo allows Reflected XSS.This issue affects Hippoo Mobile App for WooCommerce: from n/a through 1.12.0...
WordPress Hippoo Mobile App for WooCommerce plugin <= 1.12.0 - Cross Site Scripting (XSS) vulnerability
Cross Site Scripting XSS vulnerability discovered by sengtocxoen in WordPress Plugin Hippoo Mobile App for WooCommerce versions = 1.12.0...
Exploit for CVE-2026-49060
CVE-2026-49060 - Hippoo Mobile App for WooCommerce Incorrect P...